projects/Policies/New policy Prototype

New policy on public.projects

Three questions. The SQL is derived from your answers and stays visible.

Who should this policy cover?

What can they do?

Which rows?

Evaluated separately for each caller. Widening the audience above does not widen the rows anyone gets.

Advanced
How this combines with other policies
Policy name
Generated SQL

      


      

        
        
      

      


      

        What is real here. The policy is evaluated by an actual row-level-security
        interpreter over the sample table: grants, then role match, then permissive
        OR, then restrictive AND. Change anything on the left and the
        right-hand result recomputes. Nothing is scripted.
      

    


    
    
  


  
  


    

      

        What this policy will do
        
      

      

        

        

        

          Preview as 
          

        

        
        

        

        

          

            

          

          

        

        

      

    


    

      
How the request is evaluated

      

        

      

    


    

      
Policies on this table

      

        

        

          
          

            Untick to see the failure that is 13.7% of the coded corpus: a correct policy,
            and 42501 permission denied.
          

          
          

            A second permissive policy, to public.
            Tick it to watch two policies combine with OR,
            and to see rows reach callers your own policy never targeted.
          

        

      

    


    

      Sample data. Six rows in public.projects,
      owned by three users across two organisations, two of them published, plus a
      memberships table.
    

    

      The preview follows the audience. Choosing who the policy covers, on the left, decides
      which callers appear here. Scope it to signed-in users and you are previewing Ana, Ben and
      Priya. Scope it to everyone and a logged-out visitor joins them, which is the case worth
      looking at, because a rule built on auth.uid()
      returns nothing to a caller with no session.