Setting Up Supabase RLS for a Multi-Role Application

Understanding Row Level Security

Row Level Security (RLS) is PostgreSQL's built-in mechanism for controlling which rows a user can access. Supabase makes this easy to configure, but getting it right requires understanding how policies interact.

The Three Access Levels

Most applications need three distinct access levels:

1. Public (anon) — Read-only access to published content

2. Authenticated — Can submit forms and interact

3. Admin — Full CRUD access to all tables

Writing the Policies

Here's how to set up RLS for a content table:

-- Enable RLS
ALTER TABLE content ENABLE ROW LEVEL SECURITY;

-- Public can read published content
CREATE POLICY "public_read_published" ON content
  FOR SELECT USING (status = 'published');

-- Admin has full access
CREATE POLICY "admin_full_access" ON content
  FOR ALL USING (auth.uid() IS NOT NULL);

Testing Your Policies

Always verify RLS policies with both the anon key and an authenticated session. Create a test script that checks:

• Anon can read published rows but not drafts

• Anon cannot insert, update, or delete

• Authenticated admin can perform all operations