Row-Level Security (RLS)

Row-Level Security (RLS) enables fine-grained access control by automatically filtering data based on user context and policy rules. Unlike traditional authorization that controls access to entire tables or labels, RLS controls access to individual rows (nodes and relationships), ensuring users only see data they are permitted to access. <h3 id="understanding-row-level-security" class="position-relative d-flex align-items-center group"> Understanding Row-Level Security <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="understanding-row-level-security" aria-haspopup="dialog" aria-label="Share link: Understanding Row-Level Security"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>RLS works by applying security predicates to queries automatically. When a user executes a query, Geode evaluates RLS policies and filters results to include only rows matching the policy conditions. This filtering is transparent to the application and cannot be bypassed. <h4 id="how-rls-works" class="position-relative d-flex align-items-center group"> How RLS Works <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="how-rls-works" aria-haspopup="dialog" aria-label="Share link: How RLS Works"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">User Query: MATCH (c:Customer) RETURN c.name Without RLS: Returns all 10,000 customers With RLS Policy (tenant isolation): USING (c.tenant_id = current_user_property('tenant_id')) Result for User in Tenant 'acme': Returns only 500 customers belonging to 'acme' </code></pre></div> <h4 id="rls-vs-traditional-authorization" class="position-relative d-flex align-items-center group"> RLS vs Traditional Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-vs-traditional-authorization" aria-haspopup="dialog" aria-label="Share link: RLS vs Traditional Authorization"> Share link </button> </h4><table> <thead> <tr> <th>Aspect</th> <th>Traditional Authorization</th> <th>Row-Level Security</th> </tr> </thead> <tbody> <tr> <td>Granularity</td> <td>Label/Table level</td> <td>Individual row level</td> </tr> <tr> <td>Filtering</td> <td>All or nothing</td> <td>Dynamic per-row</td> </tr> <tr> <td>Context-Aware</td> <td>Limited</td> <td>Full user context</td> </tr> <tr> <td>Application Changes</td> <td>Required for filtering</td> <td>Transparent</td> </tr> <tr> <td>Performance</td> <td>Manual optimization</td> <td>Automatic optimization</td> </tr> </tbody> </table> <h3 id="creating-rls-policies" class="position-relative d-flex align-items-center group"> Creating RLS Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-rls-policies" aria-haspopup="dialog" aria-label="Share link: Creating RLS Policies"> Share link </button> </h3> <h4 id="basic-policy-syntax" class="position-relative d-flex align-items-center group"> Basic Policy Syntax <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-policy-syntax" aria-haspopup="dialog" aria-label="Share link: Basic Policy Syntax"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY policy_name ON :LabelName FOR operation_type TO role_or_user USING (predicate_expression); </code></pre></div> <h4 id="policy-components" class="position-relative d-flex align-items-center group"> Policy Components <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-components" aria-haspopup="dialog" aria-label="Share link: Policy Components"> Share link </button> </h4><ul> <li>policy_name: Unique identifier for the policy</li> <li>LabelName: Node or relationship label to protect</li> <li>operation_type: SELECT, INSERT, UPDATE, DELETE, or ALL</li> <li>role_or_user: Target role or specific user</li> <li>predicate_expression: Boolean expression that must be true for access</li> </ul> <h4 id="basic-examples" class="position-relative d-flex align-items-center group"> Basic Examples <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-examples" aria-haspopup="dialog" aria-label="Share link: Basic Examples"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Tenant isolation: Users see only their tenant's data CREATE POLICY tenant_isolation ON :Customer FOR ALL TO application_user USING (tenant_id = current_user_property('tenant_id')); -- Manager sees only their team's data CREATE POLICY manager_team_access ON :Employee FOR SELECT TO manager USING (department = current_user_property('department')); -- Users can only modify their own records CREATE POLICY self_edit ON :UserProfile FOR UPDATE TO authenticated_user USING (user_id = current_user_id()); </code></pre></div> <h3 id="operation-specific-policies" class="position-relative d-flex align-items-center group"> Operation-Specific Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="operation-specific-policies" aria-haspopup="dialog" aria-label="Share link: Operation-Specific Policies"> Share link </button> </h3> <h4 id="select-policies" class="position-relative d-flex align-items-center group"> SELECT Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="select-policies" aria-haspopup="dialog" aria-label="Share link: SELECT Policies"> Share link </button> </h4>Control which rows users can read: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Classification-based access CREATE POLICY classification_access ON :Document FOR SELECT TO employee USING (classification_level <= current_user_property('clearance_level')); -- Geographic restriction CREATE POLICY regional_data ON :CustomerData FOR SELECT TO regional_analyst USING (region = current_user_property('assigned_region')); -- Time-based visibility CREATE POLICY current_records ON :Contract FOR SELECT TO standard_user USING (end_date >= current_date() OR end_date IS NULL); </code></pre></div> <h4 id="insert-policies" class="position-relative d-flex align-items-center group"> INSERT Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="insert-policies" aria-haspopup="dialog" aria-label="Share link: INSERT Policies"> Share link </button> </h4>Control which rows users can create: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Tenant must match for new records CREATE POLICY tenant_insert ON :Order FOR INSERT TO application_user USING (tenant_id = current_user_property('tenant_id')); -- Department restriction on creation CREATE POLICY dept_create ON :Ticket FOR INSERT TO support_agent USING (assigned_department = current_user_property('department')); -- Validate ownership on creation CREATE POLICY owner_insert ON :Note FOR INSERT TO user USING (created_by = current_user_id()); </code></pre></div> <h4 id="update-policies" class="position-relative d-flex align-items-center group"> UPDATE Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="update-policies" aria-haspopup="dialog" aria-label="Share link: UPDATE Policies"> Share link </button> </h4>Control which rows users can modify: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Only modify own records CREATE POLICY self_update ON :UserSettings FOR UPDATE TO authenticated_user USING (user_id = current_user_id()); -- Manager can update team's records CREATE POLICY manager_update ON :Employee FOR UPDATE TO manager USING (department = current_user_property('department') AND employee_id != current_user_property('employee_id')); -- Prevent modification of closed records CREATE POLICY open_records_only ON :Ticket FOR UPDATE TO support_agent USING (status != 'CLOSED'); </code></pre></div> <h4 id="delete-policies" class="position-relative d-flex align-items-center group"> DELETE Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="delete-policies" aria-haspopup="dialog" aria-label="Share link: DELETE Policies"> Share link </button> </h4>Control which rows users can delete: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Users can delete their own temporary data CREATE POLICY self_delete ON :TempFile FOR DELETE TO user USING (owner_id = current_user_id()); -- Admins can delete within their tenant CREATE POLICY tenant_delete ON :AuditRecord FOR DELETE TO tenant_admin USING (tenant_id = current_user_property('tenant_id') AND created_at < current_timestamp() - INTERVAL '7 years'); -- Prevent deletion of linked records CREATE POLICY no_delete_linked ON :Customer FOR DELETE TO admin USING (NOT EXISTS( MATCH (this)-[:HAS_ORDER]->(:Order) WHERE Order.status != 'CANCELLED' )); </code></pre></div> <h3 id="policy-predicates" class="position-relative d-flex align-items-center group"> Policy Predicates <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-predicates" aria-haspopup="dialog" aria-label="Share link: Policy Predicates"> Share link </button> </h3> <h4 id="using-user-context" class="position-relative d-flex align-items-center group"> Using User Context <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="using-user-context" aria-haspopup="dialog" aria-label="Share link: Using User Context"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Current user ID USING (owner_id = current_user_id()) -- User property USING (region = current_user_property('assigned_region')) -- User roles USING (classification IN current_user_roles()) -- Session attribute USING (project_id = current_session_property('active_project')) </code></pre></div> <h4 id="complex-predicates" class="position-relative d-flex align-items-center group"> Complex Predicates <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="complex-predicates" aria-haspopup="dialog" aria-label="Share link: Complex Predicates"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Multiple conditions with AND CREATE POLICY combined_access ON :SalesData FOR SELECT TO sales_rep USING ( region = current_user_property('region') AND fiscal_year = current_user_property('active_year') AND is_confidential = false ); -- OR conditions CREATE POLICY flexible_access ON :Project FOR SELECT TO employee USING ( owner_id = current_user_id() OR team_id = current_user_property('team_id') OR is_public = true ); -- Subqueries CREATE POLICY manager_hierarchy ON :Employee FOR SELECT TO manager USING ( manager_id IN ( SELECT employee_id FROM :Employee WHERE manager_id = current_user_id() ) OR employee_id = current_user_id() ); </code></pre></div> <h4 id="graph-pattern-predicates" class="position-relative d-flex align-items-center group"> Graph Pattern Predicates <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="graph-pattern-predicates" aria-haspopup="dialog" aria-label="Share link: Graph Pattern Predicates"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Access based on relationship existence CREATE POLICY project_member ON :ProjectDocument FOR SELECT TO employee USING ( EXISTS( MATCH (this)<-[:BELONGS_TO]-(:Project)<-[:MEMBER_OF]-(u:User) WHERE u.id = current_user_id() ) ); -- Access based on graph traversal CREATE POLICY org_hierarchy ON :Report FOR SELECT TO manager USING ( EXISTS( MATCH (this)<-[:AUTHORED_BY]-(author:Employee) MATCH (author)-[:REPORTS_TO*0..3]->(mgr:Employee) WHERE mgr.id = current_user_id() ) ); </code></pre></div> <h3 id="multi-tenant-isolation" class="position-relative d-flex align-items-center group"> Multi-Tenant Isolation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-tenant-isolation" aria-haspopup="dialog" aria-label="Share link: Multi-Tenant Isolation"> Share link </button> </h3> <h4 id="complete-tenant-isolation" class="position-relative d-flex align-items-center group"> Complete Tenant Isolation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="complete-tenant-isolation" aria-haspopup="dialog" aria-label="Share link: Complete Tenant Isolation"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Apply to all labels CREATE POLICY tenant_isolation_customer ON :Customer FOR ALL TO application USING (tenant_id = current_tenant()); CREATE POLICY tenant_isolation_order ON :Order FOR ALL TO application USING (tenant_id = current_tenant()); CREATE POLICY tenant_isolation_product ON :Product FOR ALL TO application USING (tenant_id = current_tenant()); -- Helper function for cleaner policies CREATE FUNCTION current_tenant() RETURNS STRING AS $$ SELECT current_user_property('tenant_id') $$; </code></pre></div> <h4 id="cross-tenant-access-for-admins" class="position-relative d-flex align-items-center group"> Cross-Tenant Access for Admins <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="cross-tenant-access-for-admins" aria-haspopup="dialog" aria-label="Share link: Cross-Tenant Access for Admins"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Super admin sees all tenants CREATE POLICY super_admin_access ON :Customer FOR SELECT TO super_admin USING (true); -- No restriction -- Tenant admin sees only their tenant CREATE POLICY tenant_admin_access ON :Customer FOR ALL TO tenant_admin USING (tenant_id = current_tenant()); -- Support can view but not modify across tenants CREATE POLICY support_view ON :Customer FOR SELECT TO support_team USING (true); </code></pre></div> <h4 id="shared-resources" class="position-relative d-flex align-items-center group"> Shared Resources <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="shared-resources" aria-haspopup="dialog" aria-label="Share link: Shared Resources"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Some data is shared across tenants CREATE POLICY shared_templates ON :Template FOR SELECT TO application USING ( is_shared = true OR tenant_id = current_tenant() ); -- Global reference data CREATE POLICY reference_data ON :Country FOR SELECT TO application USING (true); -- Everyone can read </code></pre></div> <h3 id="hierarchical-data-access" class="position-relative d-flex align-items-center group"> Hierarchical Data Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hierarchical-data-access" aria-haspopup="dialog" aria-label="Share link: Hierarchical Data Access"> Share link </button> </h3> <h4 id="organizational-hierarchy" class="position-relative d-flex align-items-center group"> Organizational Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="organizational-hierarchy" aria-haspopup="dialog" aria-label="Share link: Organizational Hierarchy"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Employees see peers and downward CREATE POLICY org_hierarchy ON :Employee FOR SELECT TO employee USING ( -- Can see self employee_id = current_user_property('employee_id') -- Can see peers in same department OR (department = current_user_property('department') AND level <= current_user_property('level')) -- Can see direct reports (recursively) OR EXISTS( MATCH (this)-[:REPORTS_TO*1..10]->(mgr:Employee) WHERE mgr.employee_id = current_user_property('employee_id') ) ); -- Executives see everyone CREATE POLICY executive_access ON :Employee FOR SELECT TO executive USING (true); </code></pre></div> <h4 id="geographic-hierarchy" class="position-relative d-flex align-items-center group"> Geographic Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="geographic-hierarchy" aria-haspopup="dialog" aria-label="Share link: Geographic Hierarchy"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Regional managers see their region CREATE POLICY regional_access ON :Store FOR ALL TO regional_manager USING (region = current_user_property('region')); -- Country managers see all regions in country CREATE POLICY country_access ON :Store FOR ALL TO country_manager USING (country = current_user_property('country')); -- Global sees everything CREATE POLICY global_access ON :Store FOR ALL TO global_admin USING (true); </code></pre></div> <h3 id="data-classification" class="position-relative d-flex align-items-center group"> Data Classification <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-classification" aria-haspopup="dialog" aria-label="Share link: Data Classification"> Share link </button> </h3> <h4 id="classification-based-access" class="position-relative d-flex align-items-center group"> Classification-Based Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="classification-based-access" aria-haspopup="dialog" aria-label="Share link: Classification-Based Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Define classification levels -- PUBLIC = 0, INTERNAL = 1, CONFIDENTIAL = 2, SECRET = 3 -- Users see data at or below their clearance CREATE POLICY classification_policy ON :Document FOR SELECT TO employee USING (classification_level <= current_user_property('clearance')); -- Writing requires exact level match or higher clearance CREATE POLICY classification_write ON :Document FOR INSERT TO employee USING (classification_level <= current_user_property('clearance')); -- Cannot downgrade classification CREATE POLICY no_downgrade ON :Document FOR UPDATE TO employee USING ( NEW.classification_level >= OLD.classification_level OR current_user_has_role('classification_admin') ); </code></pre></div> <h4 id="category-based-access" class="position-relative d-flex align-items-center group"> Category-Based Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="category-based-access" aria-haspopup="dialog" aria-label="Share link: Category-Based Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Users have list of accessible categories CREATE POLICY category_access ON :ResearchData FOR SELECT TO researcher USING ( category = ANY(current_user_property('authorized_categories')) ); </code></pre></div> <h3 id="time-based-policies" class="position-relative d-flex align-items-center group"> Time-Based Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="time-based-policies" aria-haspopup="dialog" aria-label="Share link: Time-Based Policies"> Share link </button> </h3> <h4 id="temporal-access-control" class="position-relative d-flex align-items-center group"> Temporal Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="temporal-access-control" aria-haspopup="dialog" aria-label="Share link: Temporal Access Control"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Business hours only CREATE POLICY business_hours ON :ProductionData FOR ALL TO standard_user USING ( EXTRACT(HOUR FROM current_timestamp()) BETWEEN 8 AND 18 AND EXTRACT(DOW FROM current_timestamp()) BETWEEN 1 AND 5 ); -- Emergency override for on-call CREATE POLICY emergency_access ON :ProductionData FOR ALL TO on_call_engineer USING (true); -- Historical data access window CREATE POLICY historical_window ON :AuditLog FOR SELECT TO auditor USING ( log_date BETWEEN current_user_property('audit_start_date') AND current_user_property('audit_end_date') ); </code></pre></div> <h4 id="record-lifecycle" class="position-relative d-flex align-items-center group"> Record Lifecycle <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="record-lifecycle" aria-haspopup="dialog" aria-label="Share link: Record Lifecycle"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Only access active records CREATE POLICY active_records ON :Contract FOR SELECT TO user USING ( status = 'ACTIVE' OR (status = 'EXPIRED' AND current_user_has_role('archive_viewer')) ); -- Soft delete visibility CREATE POLICY soft_delete ON :Customer FOR SELECT TO application USING ( deleted_at IS NULL OR current_user_has_role('admin') ); </code></pre></div> <h3 id="policy-management" class="position-relative d-flex align-items-center group"> Policy Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-management" aria-haspopup="dialog" aria-label="Share link: Policy Management"> Share link </button> </h3> <h4 id="viewing-policies" class="position-relative d-flex align-items-center group"> Viewing Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="viewing-policies" aria-haspopup="dialog" aria-label="Share link: Viewing Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Show all policies SHOW POLICIES; -- Show policies for specific label SHOW POLICIES ON :Customer; -- Show policies for a role SHOW POLICIES FOR ROLE analyst; -- Detailed policy information SELECT * FROM system.rls_policies WHERE label_name = 'Customer'; </code></pre></div> <h4 id="modifying-policies" class="position-relative d-flex align-items-center group"> Modifying Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="modifying-policies" aria-haspopup="dialog" aria-label="Share link: Modifying Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Update policy predicate ALTER POLICY tenant_isolation ON :Customer USING (tenant_id = current_tenant() AND is_active = true); -- Change policy target ALTER POLICY manager_access ON :Employee TO senior_manager; -- Rename policy ALTER POLICY old_name ON :Customer RENAME TO new_name; </code></pre></div> <h4 id="disabling-and-dropping-policies" class="position-relative d-flex align-items-center group"> Disabling and Dropping Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="disabling-and-dropping-policies" aria-haspopup="dialog" aria-label="Share link: Disabling and Dropping Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Temporarily disable policy ALTER POLICY tenant_isolation ON :Customer DISABLE; -- Re-enable policy ALTER POLICY tenant_isolation ON :Customer ENABLE; -- Drop policy DROP POLICY tenant_isolation ON :Customer; -- Drop if exists DROP POLICY IF EXISTS old_policy ON :Customer; </code></pre></div> <h3 id="policy-bypass" class="position-relative d-flex align-items-center group"> Policy Bypass <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-bypass" aria-haspopup="dialog" aria-label="Share link: Policy Bypass"> Share link </button> </h3> <h4 id="bypassing-rls-for-administration" class="position-relative d-flex align-items-center group"> Bypassing RLS for Administration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="bypassing-rls-for-administration" aria-haspopup="dialog" aria-label="Share link: Bypassing RLS for Administration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant bypass ability to specific role GRANT BYPASS RLS ON :Customer TO dba; -- Session-level bypass (requires privilege) SET SESSION bypass_rls = true; -- Run query without RLS MATCH (c:Customer) RETURN count(c); -- Re-enable RLS SET SESSION bypass_rls = false; </code></pre></div> <h4 id="audit-access-without-filtering" class="position-relative d-flex align-items-center group"> Audit Access Without Filtering <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-access-without-filtering" aria-haspopup="dialog" aria-label="Share link: Audit Access Without Filtering"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Auditors need to see everything for compliance CREATE ROLE compliance_auditor; GRANT BYPASS RLS ON GRAPH * TO compliance_auditor; -- All audit queries logged even with bypass </code></pre></div> <h3 id="performance-optimization" class="position-relative d-flex align-items-center group"> Performance Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-optimization" aria-haspopup="dialog" aria-label="Share link: Performance Optimization"> Share link </button> </h3> <h4 id="indexing-for-rls" class="position-relative d-flex align-items-center group"> Indexing for RLS <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="indexing-for-rls" aria-haspopup="dialog" aria-label="Share link: Indexing for RLS"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create index on commonly filtered columns CREATE INDEX tenant_idx ON :Customer(tenant_id); CREATE INDEX department_idx ON :Employee(department); CREATE INDEX region_idx ON :Store(region); -- Composite index for multi-condition policies CREATE INDEX tenant_status_idx ON :Order(tenant_id, status); </code></pre></div> <h4 id="policy-optimization-tips" class="position-relative d-flex align-items-center group"> Policy Optimization Tips <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-optimization-tips" aria-haspopup="dialog" aria-label="Share link: Policy Optimization Tips"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- GOOD: Simple equality checks are fast USING (tenant_id = current_tenant()) -- GOOD: Indexed column lookups USING (department = current_user_property('department')) -- AVOID: Complex subqueries if possible -- Consider caching user permissions -- GOOD: Pre-computed access lists USING (id = ANY(current_user_property('accessible_ids'))) </code></pre></div> <h4 id="analyzing-policy-performance" class="position-relative d-flex align-items-center group"> Analyzing Policy Performance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="analyzing-policy-performance" aria-haspopup="dialog" aria-label="Share link: Analyzing Policy Performance"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Explain query with RLS EXPLAIN MATCH (c:Customer) RETURN c.name; -- Shows: -- Filter: (c.tenant_id = current_user_property('tenant_id')) -- Index Scan: tenant_idx -- Profile with RLS overhead PROFILE MATCH (c:Customer) RETURN c; </code></pre></div> <h3 id="testing-rls-policies" class="position-relative d-flex align-items-center group"> Testing RLS Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="testing-rls-policies" aria-haspopup="dialog" aria-label="Share link: Testing RLS Policies"> Share link </button> </h3> <h4 id="test-as-different-users" class="position-relative d-flex align-items-center group"> Test as Different Users <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="test-as-different-users" aria-haspopup="dialog" aria-label="Share link: Test as Different Users"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Switch user context for testing SET SESSION AUTHORIZATION 'test_user'; SET SESSION PROPERTY 'tenant_id' = 'acme'; -- Run query to test policy MATCH (c:Customer) RETURN count(c); -- Reset to original user RESET SESSION AUTHORIZATION; </code></pre></div> <h4 id="policy-verification-queries" class="position-relative d-flex align-items-center group"> Policy Verification Queries <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-verification-queries" aria-haspopup="dialog" aria-label="Share link: Policy Verification Queries"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Verify no cross-tenant leakage SELECT tenant_id, count(*) as count FROM Customer GROUP BY tenant_id; -- Should only show current tenant -- Verify all expected data is accessible SELECT count(*) FROM Customer WHERE tenant_id = current_tenant(); -- Compare with admin bypass count </code></pre></div> <h3 id="integration-with-other-security-features" class="position-relative d-flex align-items-center group"> Integration with Other Security Features <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="integration-with-other-security-features" aria-haspopup="dialog" aria-label="Share link: Integration with Other Security Features"> Share link </button> </h3> <h4 id="rls-with-rbac" class="position-relative d-flex align-items-center group"> RLS with RBAC <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-with-rbac" aria-haspopup="dialog" aria-label="Share link: RLS with RBAC"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- RBAC controls CAN you access the label GRANT SELECT ON :Customer TO analyst; -- RLS controls WHICH rows you can see CREATE POLICY analyst_region ON :Customer FOR SELECT TO analyst USING (region = current_user_property('region')); -- Both must pass for access </code></pre></div> <h4 id="rls-with-property-level-security" class="position-relative d-flex align-items-center group"> RLS with Property-Level Security <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-with-property-level-security" aria-haspopup="dialog" aria-label="Share link: RLS with Property-Level Security"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- RLS filters rows CREATE POLICY tenant_filter ON :Customer FOR SELECT USING (tenant_id = current_tenant()); -- Property security hides columns DENY SELECT(ssn, credit_score) ON :Customer TO analyst; -- Result: Analyst sees only tenant customers, without sensitive fields </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3> <h4 id="1-always-use-indexes" class="position-relative d-flex align-items-center group"> 1. Always Use Indexes <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="1-always-use-indexes" aria-haspopup="dialog" aria-label="Share link: 1. Always Use Indexes"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create indexes for RLS predicate columns CREATE INDEX tenant_idx ON :Customer(tenant_id); -- Dramatically improves RLS performance </code></pre></div> <h4 id="2-keep-policies-simple" class="position-relative d-flex align-items-center group"> 2. Keep Policies Simple <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="2-keep-policies-simple" aria-haspopup="dialog" aria-label="Share link: 2. Keep Policies Simple"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Simple policies are faster and easier to audit CREATE POLICY simple_tenant ON :Data USING (tenant_id = current_tenant()); -- Avoid complex nested subqueries when possible </code></pre></div> <h4 id="3-test-thoroughly" class="position-relative d-flex align-items-center group"> 3. Test Thoroughly <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="3-test-thoroughly" aria-haspopup="dialog" aria-label="Share link: 3. Test Thoroughly"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Test positive cases (should see) -- Test negative cases (should NOT see) -- Test edge cases (null values, missing properties) -- Test performance under load </code></pre></div> <h4 id="4-document-policies" class="position-relative d-flex align-items-center group"> 4. Document Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="4-document-policies" aria-haspopup="dialog" aria-label="Share link: 4. Document Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Use descriptive policy names CREATE POLICY tenant_isolation_for_compliance ON :Customer FOR ALL TO application USING (tenant_id = current_tenant()); -- Maintain external documentation for complex policies </code></pre></div> <h4 id="5-regular-audits" class="position-relative d-flex align-items-center group"> 5. Regular Audits <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="5-regular-audits" aria-haspopup="dialog" aria-label="Share link: 5. Regular Audits"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Periodically verify RLS effectiveness -- Check for bypass grants -- Review policy predicates -- Test with sample user contexts </code></pre></div> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/authorization/" >Authorization</a> - Access control overview</li> <li><a href="/tags/rbac/" >RBAC</a> - Role-based access control</li> <li><a href="/tags/authentication/" >Authentication</a> - Identity verification</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Security event tracking</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory requirements</li> <li><a href="/tags/multi-tenancy/" >Multi-Tenancy</a> - Tenant isolation patterns</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Security design</li> <li><a href="/docs/security/authorization/" >Authorization Guide</a> - Complete authorization</li> <li><a href="/docs/performance/" >Performance Tuning</a> - RLS performance optimization</li> <li>Multi-Tenant Design Patterns - Tenant isolation strategies</li> </ul>

Popular

Related Articles

Authorization