FieldProc

In a previous post I sought assistance with debugging a FieldProc program,
which worked very well, thank you. Now that I am able to debug the
FieldProc pgm, I find that it is invoked even when I am doing an sql SELECT
and even when I perform DSPPFM from the command line.

In other words, any way in which I view the file, the data is decoded.

I've read an enormous amount of material on this subject and I cannot seem
to understand how I would be able to see the data in encoded form. Perhaps
I simply need to better understand how decryption works. It seems to be
automatic. Wouldn't it be expected that the data cannot be decrypted by a
user if they lack certain permissions?

Perhaps this is where masking comes in. The system I am using requires a
PTF cume update in order to support masking. Would masking prevent the
decrypted data from being seen by a user?

If someone can point me toward relevant material, it would be greatly
appreciated.