Row Level Security for Multi-Role Warehouse Apps

Published 2025-11-27 by Faraz Rahimi

Hiding a button is not security. RLS is how a seasonal hire cannot read every exception photo or adjust every bin.

Tags: Supabase, Postgres, Security, Auth, unlisted

I write policies in English first: hires insert counts, cannot delete history. Leads update locations. Nobody reads other sites' data if we ever go multi-location.

Then I test with two users, not with the service role. If my test uses the god key, I have tested nothing.

Default deny

A new table without a policy should not be wide open. I have seen that surprise. It is not a fun surprise.

Photos follow rows

Storage paths should be unguessable and checked. An ID in a URL is not a permission.

Original post: https://farazrahimi.com/posts/row-level-security-for-multi-role-warehouse-apps