How to use a Secure Application Role

Oracle 12.2.0.1

A new project requires a DATA_OWNER account that owns data and plsql.  A DATA_READER account will only select data and will do so only through DATA_OWNER.plsql.  I have CREATE ROLE data_reader_role IDENTIFIED USING data_read_sp.  The procedure data_read_sp verifies the username, and the sets the role data_reader_role.  The DATA_READER is going to come in through a web app, but for now when I log into it from sqlplus and execute data_reader_role, a look at session_roles shows that it is indeed using the role.  The intent of the web app is that it is always logged in, or if it has to