From 802e9b0d26eebe9d40ccb7dafa9b01c7b3f7dcba Mon Sep 17 00:00:00 2001 From: Miranda Limonczenko Date: Wed, 12 Aug 2026 14:57:11 -0700 Subject: [PATCH] docs(database): separate context from procedure in Grants and policies The section ran context, then a procedure, then context again. The 42501 paragraph after the numbered steps broke the action path. - Move the 42501 explanation up with the other context. - Put the steps under their own heading so the type boundary is visible. - Tie the read-only example to step 2 instead of leaving it floating. Co-Authored-By: Claude Opus 5 --- .../guides/database/postgres/row-level-security.mdx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/apps/docs/content/guides/database/postgres/row-level-security.mdx b/apps/docs/content/guides/database/postgres/row-level-security.mdx index b46bceb2337..6d8e0eee037 100644 --- a/apps/docs/content/guides/database/postgres/row-level-security.mdx +++ b/apps/docs/content/guides/database/postgres/row-level-security.mdx @@ -72,6 +72,10 @@ Postgres runs two checks before a client touches a table. Grants decide whether On existing projects, a new table in `public` receives `select`, `insert`, `update`, and `delete` for `anon`, `authenticated`, and `service_role` automatically. Both client roles start out able to write to your table, and adding policies doesn't take those grants back. A table protected only by policies still hands `anon` an insert path if you never revoke the grant. +A missing grant raises a `42501` error before any policy runs. When a request fails that your policy should allow, check the grants before you change the policy. + +### Set the grants for a table + Set the grants to match what each role does in your app: 1. Revoke the automatic grants from both client roles. @@ -89,14 +93,14 @@ Set the grants to match what each role does in your app: 3. Enable RLS on the table and write policies that decide which rows each role reaches. -Data that clients read but never write, such as a feed a backend job populates, gets no write grant at all: +For data that clients read but never write, such as a feed a backend job populates, grant no writes in step 2: ```sql revoke all on table public.weather_readings from anon, authenticated; grant select on table public.weather_readings to anon, authenticated; ``` -A missing grant raises a `42501` error before any policy runs, so check the grants first when a request fails that your policy should allow. To stop new tables from receiving the automatic grants, see [Revoke default privileges](/docs/guides/api/securing-your-api#revoke-default-privileges). +To stop new tables from receiving the automatic grants in the first place, see [Revoke default privileges](/docs/guides/api/securing-your-api#revoke-default-privileges). ## Auto-enable RLS for new tables