Row-Level Security (RLS)¶

Implement fine-grained access control at the row level for multi-tenant applications.

Enabling RLS¶

ALTER TABLE orders ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation ON orders
FOR ALL
USING (tenant_id = current_tenant_id());

CREATE POLICY public_read ON products
FOR SELECT
TO PUBLIC
USING (published = true);

CREATE POLICY insert_own_data ON documents
FOR INSERT
WITH CHECK (owner_id = current_user_id());

Type	Description
`PERMISSIVE`	Multiple policies are OR'd together
`RESTRICTIVE`	Multiple policies are AND'd together

CREATE POLICY full_access ON accounts
FOR ALL
USING (owner_id = current_user_id())
WITH CHECK (owner_id = current_user_id());

SELECT * FROM pg_rls_policies();

\tenant rls create orders policy_name "tenant_id = current_tenant_id()"
\tenant rls list orders
\tenant rls delete orders policy_name

ALTER TABLE orders DISABLE ROW LEVEL SECURITY;
DROP POLICY policy_name ON orders;