Auditing in Java systems: RLS in the database or application-level control?

This question comes up in every project dealing with sensitive data. And the honest answer is: it...