What Is Row-Level Security (RLS)?

Row-Level Security (RLS) attaches access control policies directly to database tables. Postgres automatically filters rows based on the policy — even if the application sends a query with no WHERE clause.

Why this matters for SaaS: Application-level access control is fragile. A single bug in your API can expose all customer data. RLS moves authorization into the database itself.

How it works in Supabase:

ALTER TABLE orders ENABLE ROW LEVEL SECURITY;

CREATE POLICY "users_own_orders" ON orders
  FOR SELECT
  USING (user_id = auth.uid());

Every SELECT now automatically filters to rows where user_id matches the authenticated user. No application code needed.