---
source: https://iinventedlight.com/library/notes/postgres-row-level-security.md
title: "PostgreSQL row-level security"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "PostgreSQL License; prose restates cited source lines"
attribution: "Summary by iinventedlight (AI-assisted). Sources: PostgreSQL Global Development Group, PostgreSQL: Documentation: 18: 5.9. Row Security Policies, PostgreSQL License; PostgreSQL Global Development Group, PostgreSQL: Documentation: 18: CREATE POLICY, PostgreSQL License."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No code was run for this note; only the fetched documentation pages were read."
category: coding-references
topic_area: "code-ai-eng: PostgreSQL"
tags: ['postgresql', 'sql', 'security', 'rls']
sources:
  - id: S1
    title: "PostgreSQL: Documentation: 18: 5.9. Row Security Policies"
    publisher: PostgreSQL Global Development Group
    url: https://www.postgresql.org/docs/current/ddl-rowsecurity.html
    accessed: 2026-11-04
    license: "PostgreSQL License"
  - id: S2
    title: "PostgreSQL: Documentation: 18: CREATE POLICY"
    publisher: PostgreSQL Global Development Group
    url: https://www.postgresql.org/docs/current/sql-createpolicy.html
    accessed: 2026-11-04
    license: "PostgreSQL License"
---
# PostgreSQL row-level security

**Answer:** Enable it with `ALTER TABLE ... ENABLE ROW LEVEL SECURITY`, then add policies with `CREATE POLICY`. With RLS on and no matching policy, the default is deny: no rows are visible or updatable.

```sql
ALTER TABLE accounts ENABLE ROW LEVEL SECURITY;

CREATE POLICY account_managers ON accounts TO managers
  USING (manager = current_user);
```

## Policy parts

- **Command:** ALL (default), SELECT, INSERT, UPDATE or DELETE.
- **Roles:** default PUBLIC, meaning all roles.
- **USING:** which existing rows are visible.
- **WITH CHECK:** which new or updated rows are allowed.

## Admin notes

- Enabling and disabling row security, as well as adding policies to a table, is always the privilege of the table owner only. (S1)
- Policy names are per table.
- Manage policies with CREATE, ALTER and DROP POLICY.
- Table owners and roles with BYPASSRLS skip policies unless you use `FORCE ROW LEVEL SECURITY`.


## Claims
- id: C1
  claim: Only the table owner can enable row security and add policies.
  source: S1
  evidence: "is always the privilege of the table owner only."
- id: C2
  claim: The docs enable RLS with ALTER TABLE.
  source: S1
  evidence: "ALTER TABLE accounts ENABLE ROW LEVEL SECURITY;"
- id: C3
  claim: Without applicable policies, a default deny policy is assumed.
  source: S2
  evidence: "but no applicable policies exist, a “default deny” policy is assumed"
- id: C4
  claim: The default role is PUBLIC, applying to all roles.
  source: S2
  evidence: "The default is PUBLIC, which will apply the policy to all roles."
- id: C5
  claim: Policy names are per-table.
  source: S2
  evidence: "Policy names are per-table."

## Sources
- [S1] PostgreSQL: Documentation: 18: 5.9. Row Security Policies. PostgreSQL Global Development Group. https://www.postgresql.org/docs/current/ddl-rowsecurity.html . License: PostgreSQL License. Accessed 2026-11-04.
- [S2] PostgreSQL: Documentation: 18: CREATE POLICY. PostgreSQL Global Development Group. https://www.postgresql.org/docs/current/sql-createpolicy.html . License: PostgreSQL License. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).