Enabling RLS doesn’t tell you whether the permissions are right. We check which data each user can read or change, including through functions, views and server code.
Write down who may do what
We list resources and the operations allowed for visitors, users, team members and administrators. Those rules let us compare the intended permissions with the actual behaviour.
- Individual ownership and workspace membership
- Role changes, invitations and account lifecycle
- Background jobs and administrative operations
Review policies and other data access
We check grants, RLS, views and exposed functions. We distinguish publishable keys from privileged credentials and check where they’re used. Storage and backend access are included where relevant.
Test accounts with different permissions
We use agreed test accounts and data to verify that allowed operations succeed and prohibited ones are blocked. After a policy change, we repeat the affected cases.
Document checks for future releases
A new table or function can change data access. We leave cases to repeat after migrations, including query checks where policies might affect performance.