Row-Level Security in Plain English
Row-Level Security (RLS) is the boring database feature that quietly prevents one family from ever seeing another family's data. Here's how it works without the jargon.
The two-line summary
Every table has policies. Every query passes through those policies. If the current user isn't allowed to see a row, the row doesn't come back.
Why database-level, not app-level
App-level filtering says 'trust the code to always add WHERE family_id = mine.' Database-level filtering says 'the database won't return rows even if the code forgot.' The second is safer because bugs happen.
What a policy looks like
For the vault: SELECT is allowed if family_id equals the current user's family. INSERT is allowed if the user is inserting into their own family. Same shape for UPDATE and DELETE.
The security definer function pattern
For membership checks we use a security-definer function that runs with elevated privileges but exposes only the boolean 'yes, you're in this family.' That prevents a class of recursive-policy bugs.
What RLS doesn't protect against
A fully compromised database server. RLS is a policy layer inside Postgres, not encryption. It defends against application bugs, not root-level attackers.
Layered with GRANTs
RLS on its own isn't enough — you also need GRANTs on the table to the relevant Postgres roles. Every WarpDesk migration ships both.
Debugging RLS in practice
The 'why can't I see this row' story is 90% RLS. Our engineers use a diagnostic role in staging that shows what a policy would return for a hypothetical user.
A worked example
A staging bug once tried to fetch every vault entry ignoring the family_id. RLS returned zero rows. The bug was caught in code review the next day. The alternative — data leaking across families — was structurally impossible.
Why we insist on it for every table
Every user-data table in WarpDesk has RLS enabled. Not 'most.' Every one. That consistency is worth more than any single sophisticated policy.
Wrap it up
RLS is boring, and that's exactly why it works. Boring, consistent, always-on. The best kind of security.