Access Policy Designer Protocol

This skill enforces Zero Trust at the database layer. Instead of relying purely on the application backend to filter WHERE tenant_id = ?, it pushes security down to the database engine to prevent data leaks.

Core assumption: Application code has bugs. Database security policies (RLS/Views) are the final, unbreakable safety net against SQL Injection or logic flaws.

0. Context Intake

Before designing, make sure you have the inputs below. Read the previous workflow step's artifact first if it exists. Ask only for what is missing, in a single message, and state any assumption you make instead of blocking.

• Database engine and platform (PostgreSQL, Supabase, MySQL) and how the app connects (per-user role or shared role with session settings).
• Business access rules in plain language (who may read or change which rows or columns).
• Schema or schema-architect-output.json, including tenant and ownership columns.