The query returned data. But something was wrong. You could see rows that should have been invisible. That is the moment platform security fails, and the moment Row-Level Security (RLS) proves its worth.
Row-Level Security is a database feature that controls which rows a user can access based on their identity and permissions. It is not role-based access applied in application code. It is enforced directly by the database engine. This eliminates entire classes of leaks caused by oversight, race conditions, or inconsistent filtering logic.
In platform security, trust nothing that can drift. Application logic can drift. Configuration can drift. RLS keeps the enforcement at the lowest possible layer. Policies bind data access to the authenticated session and apply even when queries bypass the application. This closes gaps where internal tools, APIs, or ad-hoc queries might otherwise leak sensitive rows.
Implementing RLS means defining policies for each table that should be protected. These policies use WHERE clauses tied to attributes like user_id, organization_id, or security level. The database automatically applies the filter to every SELECT, UPDATE, or DELETE, without requiring developers to remember the check. Even superusers can be restricted unless explicitly granted bypass rights.