rls-policy-auditor

To audit row-level security policies, you review SELECT, INSERT, UPDATE, and DELETE commands separately to detect missing tenant filters, write-side gaps, and recursion that can leak cross-tenant data. This process verifies tenant isolation at the database layer rather than just checking configuration.

Row-level security can allow cross-tenant access due to missing WITH CHECK clauses, deny-by-default gaps, policy recursion, or frontend-derived tenant scope. Auditing these failure modes per command identifies the specific write-side holes or unsafe helpers causing the leakage.

You write negative tests by generating runnable denial SQL that attempts wrong-tenant, anon, and service-role access against your tenant tables. These tests prove cross-tenant access is denied, using positive controls for comparison to verify isolation holds.

Yes, your Postgres RLS policy needs a WITH CHECK clause for INSERT and UPDATE operations to prevent write-side gaps. A per-command policy audit flags missing WITH CHECK clauses separately from read policies to ensure tenant data cannot be corrupted.

The best way to check for service-role leakage is to perform a per-command policy audit that reviews SELECT, INSERT, UPDATE, and DELETE behavior, specifically flagging SECURITY DEFINER risks and overly broad grants that bypass tenant isolation restrictions.

Yes, you can use a policy audit to verify tenant isolation before shipping multi-tenant features by generating a per-command findings report and negative-test SQL. This proves wrong-tenant, wrong-role, and missing-auth access is blocked across all table operations.