Is there a profile at that oracle applications level, which should be the first one to fire when any

Is there a profile at that oracle applications level, which should be the first one to fire when any user is trying to access any of the Oracle applications screens,  enabling at the user level , would restrict that specific user not to access key PII data?

We can write the logic to mask the data, but I am more interested in knowing the event or profile that would be appropriate to handle this