Also known as: RLS, row-level security
Definition
Row Level Security is a Postgres feature that filters which rows of a table each user can see or modify. In Supabase apps, RLS policies are written in SQL and evaluated on every query against the authenticated user's JWT claims, making the database itself the authorization boundary.
Row Level Security is enforced by Postgres on every SELECT, INSERT, UPDATE, and DELETE against a table where RLS is enabled. Policies are SQL expressions that return true or false for each row given the current session's claims.
In a Supabase + Next.js app, the session is the user's JWT, and the canonical claim is auth.uid(). A typical "users only see their own rows" policy reads using (auth.uid() = user_id). Without that policy, the table denies all access to authenticated users by default once RLS is enabled.
The anon key respects RLS; the service_role key bypasses it. That asymmetry is the architectural point: the anon key is safe to ship to the browser because RLS gates every query, while service_role belongs only on the server.
On every table that holds user data. The recommended posture is enable-and-deny-all: turn RLS on, write no policies, then add policies one at a time as needs surface. A missing policy fails closed (denies access) rather than failing open (allowing access).