A mental model for Row-Level Security

If you remember one thing about RLS, remember this: it is a WHERE clause the database injects for you.

USING controls which rows are visible to SELECT, UPDATE, and DELETE. WITH CHECK controls which rows an INSERT or UPDATE is allowed to produce. The two are independent, and confusing them is the source of most RLS bugs.

Roles matter. The default `public` grant is gone in modern Supabase setups — if you don't GRANT, RLS doesn't even get a chance to evaluate.

Test policies with `SET ROLE` from psql. It is the fastest feedback loop you'll find, and it forces you to think about the principal making the request rather than the row being touched.