# Aurabase Row-Level Security (RLS) Production Guide

> Documentation: https://aurabase.cloud/en/docs/guides/rls
> Engine: Native PostgreSQL 18 Row-Level Security

## Core Principles
1. **Database Roles**:
   - `aura_anon`: Unauthenticated public visitors.
   - `aura_authenticated`: Logged-in users carrying a valid JWT.
   - `aura_service_role`: High-privilege backend service role (bypasses RLS by design).
2. **Available SQL Helpers**:
   - `auth.uid()`: Returns authenticated user UUID (`NULL` when anonymous).
   - `auth.role()`: Returns role from JWT claims.
   - `auth.tenant()`: Returns organization ID (`app_metadata.tenant`).
   - `auth.has_role('admin')`: Verifies user organization role.

## 3 Standard Production Patterns

### Pattern 1: Ownership
Each user only accesses their own records:
```sql
alter table profiles enable row level security;
alter table profiles force row level security;

-- Read: read own profile
create policy "profiles_read_own" on profiles
  for select to aura_authenticated
  using (auth.uid() = user_id);

-- Write: update own profile
create policy "profiles_write_own" on profiles
  for all to aura_authenticated
  using (auth.uid() = user_id)
  with check (auth.uid() = user_id);
```

### Pattern 2: Multi-Tenant B2B Isolation
All records within an organization are scoped by `tenant_id`:
```sql
alter table orders enable row level security;

create policy "orders_tenant_isolation" on orders
  for all to aura_authenticated
  using (tenant_id = auth.tenant())
  with check (tenant_id = auth.tenant());

-- Essential index for performance
create index idx_orders_tenant on orders(tenant_id);
```

### Pattern 3: Hierarchical Role-Based Permissions
Fine-grained access based on user role within the tenant:
```sql
alter table invoices enable row level security;

-- Members with 'billing' or 'admin' role can read
create policy "invoices_read_policy" on invoices
  for select to aura_authenticated
  using (
    tenant_id = auth.tenant()
    and (auth.has_role('admin') or auth.has_role('billing'))
  );

-- Only 'admin' role can mutate invoices
create policy "invoices_write_policy" on invoices
  for all to aura_authenticated
  using (tenant_id = auth.tenant() and auth.has_role('admin'))
  with check (tenant_id = auth.tenant());
```