Row-level security checklist
Five checks before trusting Postgres RLS with tenant isolation: force it, test it as the app role, and never let the pool leak a tenant.
planted 1 min read
ALTER TABLE … FORCE ROW LEVEL SECURITY(owners bypass it otherwise).- The app connects as a role that does not own the tables.
- Tenant comes from
SET LOCAL app.tenant_idinside the transaction, never a session-levelSET, so pooled connections can't carry it over. - A test that queries every table as tenant A and asserts zero rows from tenant B.
- Indexes lead with
tenant_id, or the policy turns every query into a scan.
Context: Designing Multi-Tenant Database Architectures and the tenancy model in CaseCloud: multi-tenant legal SaaS with RAG over 80M+ judgments. Background reading: Designing Data-Intensive Applications.
Links from this note
Jun 10, 2026Designing Multi-Tenant Database ArchitecturesA comprehensive guide to the different approaches for building multi-tenant databases in SaaS applications.Read Dec 15, 2025CaseCloud: multi-tenant legal SaaS with RAG over 80M+ judgmentsRead Mar 14, 2025Designing Data-Intensive ApplicationsThe book I reread before every schema or messaging decision. My notes map its chapters to systems I've actually run.Read