Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
PostgreSQL row-level security (RLS) adds rules that decide which individual table rows a database role may read, change, add, or delete. It works alongside ordinary SQL privileges: a role needs the relevant table privilege and must also pass an applicable RLS policy.
What row-level security does
Ordinary SQL privileges answer questions such as whether a role may run SELECT or UPDATE on a table. RLS adds a second question: which rows may that role access? For example, a policy can limit managers to rows assigned to them, or let each user access only their own row. [PostgreSQL 18 row security]
An RLS policy is a Boolean rule PostgreSQL applies to rows for specified roles and commands. The table owner must enable RLS; creating a policy alone does not turn it on. Once enabled, if no applicable policy allows an operation, PostgreSQL denies row access by default. [PostgreSQL 18 row security] [PostgreSQL 17 CREATE POLICY]
How to enable RLS and add a policy
The following PostgreSQL 18 example enables RLS on accounts and adds a policy for the managers role. It assumes the table, role, and manager column already exist.
#1 Best Overall
ALTER TABLE accounts ENABLE ROW LEVEL SECURITY;
CREATE POLICY account_managers ON accounts TO managers
USING (manager = current_user);The policy’s USING condition compares the row’s manager value with the current database role name. Because the policy does not specify a separate WITH CHECK, PostgreSQL reuses the USING expression to check proposed rows for writes. [PostgreSQL 18 row security]
This example assumes database roles correspond to the manager identities being checked. If an application connects all end users through one shared database role, current_user identifies that database role, not automatically the individual application user. The application needs an identity-propagation design suited to its architecture.
Rank #2
How USING and WITH CHECK differ
USING tests existing rows considered by an operation: it determines which rows are visible or can be targeted. WITH CHECK tests the row values an INSERT or UPDATE would produce. [PostgreSQL 17 CREATE POLICY]
Recommended Free Tools
- Read or target existing rows: use
USINGto limit which rows a role can see or affect. - Validate inserted or updated values: use
WITH CHECKto prevent a write from creating a row, or changing a row, into a state the policy does not allow. - Use separate rules when needed: a role may be allowed to update a row it can see, but only if the resulting row still meets a distinct condition. Define both expressions when visibility and permitted new values differ.
If a policy applies to a command that supports both expressions and omits WITH CHECK, PostgreSQL uses its USING expression for the check. [PostgreSQL 17 CREATE POLICY]
How policy scope and combination work
A policy can be scoped to particular database roles and commands. The command scope can cover all commands with ALL, or specify SELECT, INSERT, UPDATE, or DELETE. If multiple applicable policies exist, their types determine how their conditions combine. [PostgreSQL 17 CREATE POLICY]
- Permissive policies are the default and combine with OR: a row passes if an applicable permissive policy allows it.
- Restrictive policies combine with AND: their conditions add requirements that must also pass.
When choosing policy scope, decide which roles and commands need access, whether a policy should grant an alternative route or impose an additional restriction, and whether writes need a separate check on proposed row values.
Which roles bypass RLS?
Superusers and roles with the BYPASSRLS attribute bypass row-security checks. Table owners normally bypass RLS on their own tables as well; an owner can make the table owner subject to policies by enabling forced row security with ALTER TABLE ... FORCE ROW LEVEL SECURITY. [PostgreSQL 18 row security]
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThat is why testing as the table owner can produce different results from testing as the application role. Validate behavior using the role that will actually run the application, and account for any superuser or BYPASSRLS privileges in that role.
What RLS does not protect
RLS policies do not govern whole-table TRUNCATE or REFERENCES operations. Referential-integrity and uniqueness checks also bypass row-security filtering, so constraint outcomes can sometimes reveal indirect information about rows a role cannot directly see. RLS should not be treated as a guarantee that hidden row values can never be inferred. [PostgreSQL 18 row security] [PostgreSQL 17 CREATE POLICY]
Practical checks before relying on a policy
- Confirm the table owner has enabled RLS on each protected table.
- Grant the role the ordinary SQL privileges it needs; an RLS policy does not replace
GRANT. - Check that the policy applies to the intended roles and commands.
- Review both existing-row access (
USING) and proposed-row validation (WITH CHECK). - Test as the application role, not only as the table owner or an administrator.
- Account for operations and integrity checks that RLS does not filter.
Policy syntax and behavior should be checked against the PostgreSQL major version in use. The examples here draw on the PostgreSQL 18 row-security chapter and PostgreSQL 17 CREATE POLICY reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
