Glossary
Row-level security
A database feature that restricts which rows a role can read or change, whatever the query says. What keeps one company’s records from another’s on a shared install.
Row-level security (RLS) is a database feature that restricts which rows a role can read or change, whatever the query says. In PostgreSQL, once it’s enabled on a table, normal access must be allowed by a policy, and with no policy the default is to deny.
It matters for software that holds several companies’ data on one install. A filter in the application can be forgotten in one query; a policy in the database applies anyway.
Two details are worth checking. Table owners normally bypass it unless the table has FORCE ROW LEVEL SECURITY, and superusers and roles with BYPASSRLS always do. Soldlyne forces it on every business table and has its app work through a restricted role.