Row-Level Security (RLS)

Row-Level Security (RLS) in Geode provides fine-grained access control at the node and relationship level, allowing you to restrict which graph elements users can access based on flexible policy rules. This is essential for multi-tenant applications, data privacy compliance, and protecting sensitive information within shared graph databases. <h3 id="understanding-row-level-security" class="position-relative d-flex align-items-center group"> Understanding Row-Level Security <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="understanding-row-level-security" aria-haspopup="dialog" aria-label="Share link: Understanding Row-Level Security"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Traditional database access control operates at the table or column level, granting or denying access to entire datasets. Row-Level Security goes further by controlling access to individual rows (in Geode’s case, nodes and relationships) based on the context of the query and the user executing it. In graph databases, RLS enables: <ul> <li>Multi-tenant isolation: Different customers see only their data</li> <li>Data compartmentalization: Users access only data relevant to their role</li> <li>Privacy compliance: Automatic filtering of sensitive information</li> <li>Hierarchical access: Organizational structures reflected in data access</li> <li>Attribute-based access: Access based on node properties and relationships</li> </ul> <h3 id="rls-policy-basics" class="position-relative d-flex align-items-center group"> RLS Policy Basics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-policy-basics" aria-haspopup="dialog" aria-label="Share link: RLS Policy Basics"> Share link </button> </h3>RLS policies in Geode consist of: <ul> <li>Target: The node labels or relationship types the policy applies to</li> <li>Operation: SELECT, INSERT, UPDATE, or DELETE</li> <li>Role: Which users/roles the policy applies to</li> <li>Condition: A GQL expression that determines access</li> </ul> <h4 id="creating-basic-policies" class="position-relative d-flex align-items-center group"> Creating Basic Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-basic-policies" aria-haspopup="dialog" aria-label="Share link: Creating Basic Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Only allow users to see their own data CREATE POLICY user_isolation ON Person FOR SELECT TO authenticated_user USING (person_id = current_user()); -- Allow managers to see their team's data CREATE POLICY manager_team_access ON Employee FOR SELECT TO manager USING (manager_id = current_user()); -- Allow admins to see everything CREATE POLICY admin_full_access ON Person FOR ALL TO admin USING (true); </code></pre></div> <h4 id="policy-evaluation" class="position-relative d-flex align-items-center group"> Policy Evaluation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-evaluation" aria-haspopup="dialog" aria-label="Share link: Policy Evaluation"> Share link </button> </h4>When a query executes, Geode: <ol> <li>Identifies the user’s roles</li> <li>Finds all applicable RLS policies</li> <li>Combines policy conditions with AND logic for restrictive policies</li> <li>Combines policy conditions with OR logic for permissive policies</li> <li>Automatically adds conditions to query WHERE clauses</li> </ol> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- User executes this query MATCH (p:Person) RETURN p.name, p.email; -- With user_isolation policy, Geode executes MATCH (p:Person) WHERE p.person_id = current_user() -- Automatically added by RLS RETURN p.name, p.email; </code></pre></div> <h3 id="multi-tenant-applications" class="position-relative d-flex align-items-center group"> Multi-Tenant Applications <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-tenant-applications" aria-haspopup="dialog" aria-label="Share link: Multi-Tenant Applications"> Share link </button> </h3>RLS is ideal for SaaS applications serving multiple customers: <h4 id="tenant-isolation" class="position-relative d-flex align-items-center group"> Tenant Isolation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tenant-isolation" aria-haspopup="dialog" aria-label="Share link: Tenant Isolation"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create tenant isolation policy CREATE POLICY tenant_isolation ON (n) -- Applies to all node types FOR ALL TO tenant_user USING (n.tenant_id = current_tenant_id()); -- Optionally, restrict at relationship level too CREATE POLICY tenant_relationship_isolation ON ()-[r]-() FOR ALL TO tenant_user USING (start_node(r).tenant_id = current_tenant_id() AND end_node(r).tenant_id = current_tenant_id()); </code></pre></div>Every node includes a <code>tenant_id</code> property: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create customer data with tenant ID CREATE (:Customer { name: 'Acme Corp', tenant_id: 'tenant_123', email: 'contact@acme.com' }); -- User from tenant_123 can see this -- Users from other tenants cannot </code></pre></div> <h4 id="shared-reference-data" class="position-relative d-flex align-items-center group"> Shared Reference Data <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="shared-reference-data" aria-haspopup="dialog" aria-label="Share link: Shared Reference Data"> Share link </button> </h4>Some data may be shared across tenants: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Allow all tenants to see shared reference data CREATE POLICY shared_data_access ON ReferenceData FOR SELECT TO tenant_user USING (is_shared = true OR tenant_id = current_tenant_id()); -- Create shared data CREATE (:ReferenceData { type: 'country', name: 'United States', is_shared: true }); </code></pre></div> <h3 id="hierarchical-access-control" class="position-relative d-flex align-items-center group"> Hierarchical Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hierarchical-access-control" aria-haspopup="dialog" aria-label="Share link: Hierarchical Access Control"> Share link </button> </h3>Model organizational hierarchies with RLS: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Employees can see their own data CREATE POLICY employee_self_access ON Employee FOR SELECT TO employee USING (employee_id = current_user()); -- Managers can see their direct reports CREATE POLICY manager_reports_access ON Employee FOR SELECT TO manager USING ( manager_id = current_user() OR employee_id = current_user() ); -- Directors can see entire department CREATE POLICY director_department_access ON Employee FOR SELECT TO director USING ( department IN get_managed_departments(current_user()) OR employee_id = current_user() ); -- Executives can see everything CREATE POLICY executive_all_access ON Employee FOR SELECT TO executive USING (true); </code></pre></div> <h4 id="graph-based-hierarchy" class="position-relative d-flex align-items-center group"> Graph-Based Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="graph-based-hierarchy" aria-haspopup="dialog" aria-label="Share link: Graph-Based Hierarchy"> Share link </button> </h4>Use the graph structure itself for hierarchical access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Access based on organizational graph structure CREATE POLICY org_hierarchy_access ON Employee FOR SELECT TO employee USING ( EXISTS { MATCH path = (current:Employee {id: current_user()})-[:MANAGES*0..]->(e:Employee) WHERE e = this -- 'this' refers to the current Employee node being checked } ); </code></pre></div> <h3 id="attribute-based-access-control" class="position-relative d-flex align-items-center group"> Attribute-Based Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="attribute-based-access-control" aria-haspopup="dialog" aria-label="Share link: Attribute-Based Access Control"> Share link </button> </h3>Define access based on node properties: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Access based on security clearance level CREATE POLICY clearance_based_access ON Document FOR SELECT TO employee USING ( required_clearance <= get_user_clearance(current_user()) ); -- Access based on data classification CREATE POLICY classification_access ON DataAsset FOR SELECT TO analyst USING ( classification IN ['public', 'internal'] OR (classification = 'confidential' AND user_has_approval(current_user(), this.id)) ); -- Time-based access CREATE POLICY time_limited_access ON TemporaryData FOR SELECT TO user USING ( valid_from <= current_timestamp() AND valid_until >= current_timestamp() ); </code></pre></div> <h3 id="column-level-security-with-rls" class="position-relative d-flex align-items-center group"> Column-Level Security with RLS <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="column-level-security-with-rls" aria-haspopup="dialog" aria-label="Share link: Column-Level Security with RLS"> Share link </button> </h3>Restrict access to specific properties: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Policy that only exposes certain properties CREATE POLICY employee_limited_view ON Employee FOR SELECT TO public WITH COLUMNS (name, title, department, email) USING (is_public_directory_enabled = true); -- Sensitive properties like salary not included MATCH (e:Employee) RETURN e.name, e.salary; -- salary is NULL for public role </code></pre></div> <h3 id="conditional-insertupdate-policies" class="position-relative d-flex align-items-center group"> Conditional Insert/Update Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="conditional-insertupdate-policies" aria-haspopup="dialog" aria-label="Share link: Conditional Insert/Update Policies"> Share link </button> </h3>Control data modifications with RLS: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Users can only insert data for their tenant CREATE POLICY tenant_insert_restriction ON (n) FOR INSERT TO tenant_user USING (n.tenant_id = current_tenant_id()); -- Users can only update their own data CREATE POLICY self_update_only ON Person FOR UPDATE TO authenticated_user USING (person_id = current_user()); -- Prevent deletion of archived records CREATE POLICY prevent_archive_deletion ON Record FOR DELETE TO user USING (status != 'archived'); </code></pre></div> <h3 id="policy-functions" class="position-relative d-flex align-items-center group"> Policy Functions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-functions" aria-haspopup="dialog" aria-label="Share link: Policy Functions"> Share link </button> </h3>Create reusable functions for complex policies: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Define helper function CREATE FUNCTION is_accessible_to_user(node_id STRING, user_id STRING) RETURNS BOOLEAN AS $$ MATCH (u:User {id: $user_id}) MATCH (n {id: $node_id}) RETURN EXISTS { MATCH (u)-[:HAS_ACCESS|MANAGES*1..3]->(n) } $$; -- Use in policy CREATE POLICY complex_access_policy ON Document FOR SELECT TO user USING (is_accessible_to_user(this.id, current_user())); </code></pre></div> <h3 id="performance-optimization" class="position-relative d-flex align-items-center group"> Performance Optimization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-optimization" aria-haspopup="dialog" aria-label="Share link: Performance Optimization"> Share link </button> </h3>RLS policies can impact query performance if not carefully designed: <h4 id="index-filtered-properties" class="position-relative d-flex align-items-center group"> Index Filtered Properties <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="index-filtered-properties" aria-haspopup="dialog" aria-label="Share link: Index Filtered Properties"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create index on frequently filtered property CREATE INDEX tenant_id_index ON (n) FOR (n.tenant_id); -- Policy uses indexed property CREATE POLICY tenant_isolation ON (n) FOR SELECT TO tenant_user USING (n.tenant_id = current_tenant_id()); -- Uses index </code></pre></div> <h4 id="avoid-complex-subqueries" class="position-relative d-flex align-items-center group"> Avoid Complex Subqueries <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="avoid-complex-subqueries" aria-haspopup="dialog" aria-label="Share link: Avoid Complex Subqueries"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Inefficient: Complex EXISTS subquery for every node CREATE POLICY slow_policy ON Document FOR SELECT TO user USING ( EXISTS { MATCH (u:User {id: current_user()})-[:BELONGS_TO]->(g:Group)-[:CAN_ACCESS]->(this) } ); -- More efficient: Pre-compute accessible documents CREATE POLICY fast_policy ON Document FOR SELECT TO user USING ( this.id IN get_accessible_documents(current_user()) -- Cached function ); </code></pre></div> <h4 id="policy-caching" class="position-relative d-flex align-items-center group"> Policy Caching <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-caching" aria-haspopup="dialog" aria-label="Share link: Policy Caching"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable policy evaluation caching geode serve --rls-cache-enabled=true \ --rls-cache-size=100MB \ --rls-cache-ttl=300s </code></pre></div> <h3 id="testing-rls-policies" class="position-relative d-flex align-items-center group"> Testing RLS Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="testing-rls-policies" aria-haspopup="dialog" aria-label="Share link: Testing RLS Policies"> Share link </button> </h3>Verify policies work correctly: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Test as specific user SET ROLE 'employee'; SET SESSION current_user = 'alice@example.com'; MATCH (e:Employee) RETURN count(e); -- Should only see accessible employees -- Test as admin SET ROLE 'admin'; MATCH (e:Employee) RETURN count(e); -- Should see all employees -- Verify policy enforcement EXPLAIN MATCH (e:Employee) RETURN e; -- Plan should show RLS filter: WHERE e.employee_id = current_user() </code></pre></div> <h4 id="automated-policy-testing" class="position-relative d-flex align-items-center group"> Automated Policy Testing <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="automated-policy-testing" aria-haspopup="dialog" aria-label="Share link: Automated Policy Testing"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Run RLS policy test suite geode test-rls --policy=employee_access \ --test-users=alice,bob,admin \ --expected-results=test-cases.json </code></pre></div> <h3 id="policy-management" class="position-relative d-flex align-items-center group"> Policy Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-management" aria-haspopup="dialog" aria-label="Share link: Policy Management"> Share link </button> </h3> <h4 id="viewing-policies" class="position-relative d-flex align-items-center group"> Viewing Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="viewing-policies" aria-haspopup="dialog" aria-label="Share link: Viewing Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- List all policies SHOW POLICIES; -- Show policies for specific label SHOW POLICIES ON Employee; -- Show policy details DESCRIBE POLICY employee_self_access; </code></pre></div> <h4 id="modifying-policies" class="position-relative d-flex align-items-center group"> Modifying Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="modifying-policies" aria-haspopup="dialog" aria-label="Share link: Modifying Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Drop policy DROP POLICY employee_self_access; -- Recreate with updated condition CREATE POLICY employee_self_access ON Employee FOR SELECT TO employee USING (employee_id = current_user() OR is_manager = true); -- Disable policy temporarily ALTER POLICY employee_self_access DISABLE; -- Re-enable policy ALTER POLICY employee_self_access ENABLE; </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3><ol> <li>Start with deny-all: Create restrictive policies by default, then grant access</li> <li>Use indexed properties: Filter on indexed properties for performance</li> <li>Test thoroughly: Verify policies with different user roles and scenarios</li> <li>Keep policies simple: Complex policies are hard to maintain and slow to evaluate</li> <li>Document policies: Clearly document the intent and scope of each policy</li> <li>Monitor performance: Track query performance impact of RLS policies</li> <li>Use policy functions: Extract complex logic into reusable functions</li> <li>Regular audits: Periodically review and update policies</li> <li>Principle of least privilege: Grant minimum necessary access</li> <li>Combine with RBAC: Use RLS together with role-based access control</li> </ol> <h3 id="common-patterns" class="position-relative d-flex align-items-center group"> Common Patterns <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="common-patterns" aria-haspopup="dialog" aria-label="Share link: Common Patterns"> Share link </button> </h3> <h4 id="department-based-access" class="position-relative d-flex align-items-center group"> Department-Based Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="department-based-access" aria-haspopup="dialog" aria-label="Share link: Department-Based Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY department_isolation ON Employee FOR SELECT TO department_user USING (department = get_user_department(current_user())); </code></pre></div> <h4 id="time-based-access" class="position-relative d-flex align-items-center group"> Time-Based Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="time-based-access" aria-haspopup="dialog" aria-label="Share link: Time-Based Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY business_hours_access ON SensitiveData FOR SELECT TO employee USING ( extract_hour(current_timestamp()) BETWEEN 9 AND 17 AND extract_dow(current_timestamp()) BETWEEN 1 AND 5 ); </code></pre></div> <h4 id="geographic-restrictions" class="position-relative d-flex align-items-center group"> Geographic Restrictions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="geographic-restrictions" aria-haspopup="dialog" aria-label="Share link: Geographic Restrictions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY geographic_restriction ON CustomerData FOR SELECT TO analyst USING (region IN get_user_regions(current_user())); </code></pre></div> <h4 id="data-owner-access" class="position-relative d-flex align-items-center group"> Data Owner Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-owner-access" aria-haspopup="dialog" aria-label="Share link: Data Owner Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY owner_access ON Document FOR ALL TO user USING (created_by = current_user() OR owner = current_user()); </code></pre></div> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3> <h4 id="policy-not-applied" class="position-relative d-flex align-items-center group"> Policy Not Applied <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-not-applied" aria-haspopup="dialog" aria-label="Share link: Policy Not Applied"> Share link </button> </h4>Check that: <ol> <li>User has correct role assigned</li> <li>Policy target matches query pattern</li> <li>Policy is enabled: <code>SHOW POLICIES</code></li> <li>No conflicting policies</li> </ol> <h4 id="performance-issues" class="position-relative d-flex align-items-center group"> Performance Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-issues" aria-haspopup="dialog" aria-label="Share link: Performance Issues"> Share link </button> </h4><ol> <li>Add indexes on filtered properties</li> <li>Simplify policy conditions</li> <li>Use policy evaluation caching</li> <li>Monitor with <code>EXPLAIN</code> to see added filters</li> </ol> <h4 id="access-denied-unexpectedly" class="position-relative d-flex align-items-center group"> Access Denied Unexpectedly <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="access-denied-unexpectedly" aria-haspopup="dialog" aria-label="Share link: Access Denied Unexpectedly"> Share link </button> </h4><ol> <li>Review all applicable policies with <code>SHOW POLICIES</code></li> <li>Test policy condition manually</li> <li>Check if multiple policies conflict</li> <li>Verify user role and session context</li> </ol> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory compliance with RLS</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Track RLS policy enforcement</li> <li><a href="/docs/security/authentication/" >Authentication</a> - User authentication and identity</li> <li><a href="/docs/security/authorization/" >Authorization</a> - Role-based access control</li> <li><a href="/docs/performance/" >Performance</a> - Optimizing RLS policy performance</li> <li><a href="/docs/security/" >Security Overview</a> - Security best practices</li> </ul>

Popular

Related Articles

Security and Compliance Guide