Explanation:

Step 1: Create a new user role and add required privileges.
Individual security permissions are combined into privileges, and privileges are combined into duties. The administrator grants security roles access to the program by assigning duties and privileges to those roles.
Step 2: Assign the newly created role to the user.
Step 3: Define the list of constrained tables.
Add the constrained tables and views.
Step 4: Define the context of the rule.
Set the context.
Set the ContextType property to one of the following:
* ContextString - Set the property to this value if a global context is to be used to determine whether the policy should be applied. When required, this context string needs to be set by the application using the XDS::SetContext API.
* RoleName - Set the property to this value if the policy should be applied only if a user in a specific role accesses the constrained tables.
* RoleProperty - Set the property to this value if the policy is to be applied only if the user is a member of any one of a set of roles that have the ContextString property set to the same value.

Reference:
https://docs.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/sysadmin/security-architecture
https://community.dynamics.com/365/b/exploringdynamics365/posts/extensible-data-security-in-d365