The RLS Field Guide · back cover

You inherited an authorization model you did not design. This field guide takes you from "what is a policy" to "my tenant isolation is proven by tests that run on every pull request."

Across ten chapters and four reference appendices, using one fabricated two-tenant example app disclosed as fabricated, you will:

• trace a request from browser to Postgres and learn who the database thinks is asking;
• read policies clause by clause — using, with check, permissive, restrictive — with proofs you run yourself;
• build a complete policy set for a two-tenant app, then prove its boundaries five ways;
• recognize the five drift patterns by which secure projects quietly become insecure;
• perform the full manual audit in one afternoon with nothing but catalog queries;
• wire isolation proofs into pgTAP and CI so drift fails a build instead of leaking data;
• make policies fast enough that nobody is tempted to disable them.

Every SQL block runs as written. Every claim links to official Supabase or Postgres documentation.

When you want the same audit repeated continuously — findings with remediation SQL you review and apply, and monitoring for the drift this book teaches you to detect — run a free audit of your project at rowshield.dev/audit — no account required.

---

RowShield is an independent product and is not affiliated with, endorsed by, or sponsored by Supabase, Inc.