According to the oracle documentation https://docs.oracle.com/database/121/DBSEG/vpd.htm#DBSEG249 it is about creating a function to define a predicate and then its corresponding policy based on that function defined for say to which columns it will be applied,
For this example it indicates that only X user is allowed to consult X table, but when another user Z is the one that consults table X, the information of those columns is not shown since it returns as null or according to the client it returns as empty .
There is some parameterization for that column protection to return a value other than null or empty. ??