A defense contractor's data warehouse allows analysts to run aggregate queries (counts, averages) over classified personnel records. A security review discovers that by combining several narrowly-scoped aggregate queries, an analyst can deduce the identity and clearance status of a specific individual—information they are not authorized to see directly. Which database security control BEST addresses this specific weakness?