postgres-core-rls-policies

Quick Reference :

Row-Level Security (RLS) adds per-row visibility and mutability filters that act as implicit WHERE clauses on every query. RLS is enforced by PostgreSQL itself, not by application code, which makes it the only correct primitive for multi-tenant isolation on a shared schema.

Four facts to internalize before writing any policy :

1. RLS is OFF by default. ALTER TABLE t ENABLE ROW LEVEL SECURITY turns it on. When enabled with NO policies, the default is deny everything for non-owners.
2. The table owner and any role with BYPASSRLS skip policies entirely. Apply ALTER TABLE t FORCE ROW LEVEL SECURITY to subject the owner to policies (does NOT affect BYPASSRLS or superuser).
3. USING (expr) filters EXISTING rows (visibility for SELECT, UPDATE-target, DELETE). WITH CHECK (expr) validates NEW row values (INSERT, post-UPDATE). UPDATE policies need BOTH or users can update to rows they could not insert.
4. PERMISSIVE policies (default) are OR-combined. RESTRICTIVE policies are AND-combined. The full predicate is (R1 AND R2 AND ...) AND (P1 OR P2 OR ...). At least one PERMISSIVE policy must exist or every query returns zero rows.

Two-line minimum-viable policy (per-user task ownership) :