rls-guardian

Enforce RLS policies on PostgreSQL tables during migrations.

Updated Mar 13, 2026
One-click install
npx skills add https://github.com/jtucker9/mystuff --skill rls-guardian
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rls-guardian
Source: https://github.com/jtucker9/mystuff/tree/main/skills/security/rls-guardian
Command: npx skills add https://github.com/jtucker9/mystuff --skill rls-guardian

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automatically enforces row-level security policies on new or modified PostgreSQL tables during migrations to prevent insecure live schemas.

Core Features & Use Cases

  • Intercepts CREATE TABLE and ALTER TABLE changes to classify access patterns (OWNERSHIP, TENANT, PUBLIC_READ, ADMIN_ONLY, VISIBILITY, RELATIONSHIP).
  • Generates complete RLS policy sets and assesses FORCE RLS and performance considerations for production deployments.
  • Useful for multi-tenant apps and security-focused migrations where policy drift is a risk and must be verifiable.

Quick Start

Apply RLS policy templates to a new or updated table and run migration tests to verify correct enforcement.

Frequently Asked Questions about rls-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce row-level security policies automatically during Postgres migrations?

You can enforce row-level security during migrations by intercepting CREATE TABLE and ALTER TABLE changes to automatically generate complete RLS policy SQL. This ensures FORCE RLS is applied and prevents insecure schema changes in production.

What access patterns should I classify when setting up multi-tenant row-level security?

When setting up row-level security for multi-tenant models, classify access patterns such as OWNERSHIP, TENANT, PUBLIC_READ, ADMIN_ONLY, VISIBILITY, and RELATIONSHIP. This classification determines the specific RLS policies generated for each table.

How do I prevent RLS policy drift when modifying existing database tables?

To prevent RLS policy drift when modifying tables, intercept schema changes during migrations to assess and generate complete policy sets. This process flags potential migration gaps for review and ensures FORCE RLS is maintained.

Can I apply row-level security templates to existing tables without breaking access control?

Yes, you can apply RLS policy templates to updated tables by classifying their access patterns and generating complete policy SQL. The templates assess FORCE RLS and performance considerations to ensure access control remains intact during deployment.

When do I need to use FORCE RLS in PostgreSQL security policies?

You need FORCE RLS in PostgreSQL security policies when table owners must also be subject to row-level restrictions. It is automatically assessed and applied when generating complete RLS policy sets for new or modified tables during migrations.

What are the limitations of automatically generated row-level security policies?

Automatically generated row-level security policies may flag potential migration gaps that require manual review. Performance considerations for production deployments must be assessed, and complex access patterns might need verification through migration tests.