RLS as a second layer of defence

All four previous lessons rest on one thing: somebody remembering to write the right clause. A WHERE clause needs an author, a shared Expression needs a caller, a DTO needs a declaration. Row Level Security is the one layer that needs nobody to remember anything — it runs inside the database, after every query, including a query typed into psql by hand at 3am.

How it works, briefly: you declare a policy on a table, and Postgres adds that policy's condition to every query touching the table. Not "check, then refuse" but a row that fails the condition does not exist as far as that query is concerned. SELECT count(*) returns a smaller number; UPDATE updates nothing; DELETE deletes nothing.

What makes it categorically different from the previous four:

And here is the part that must be said plainly, because it is this lesson's biggest trap: RLS is the second layer, not the first. Enabling RLS and then dropping the WHERE clause from your code is a mistake: you lose the ability to read the rule from application code, you lose control over performance (the policy joins your query plan), and you place all authorisation in a mechanism that one misconfigured connection turns off entirely.