Why wrap auth.uid() in a select?

Writing (select auth.uid()) lets Postgres evaluate it once per query instead of once per row, which is much faster on large tables.

Do I need both USING and WITH CHECK?

USING filters which existing rows a user can see or change. WITH CHECK validates the new row on insert and update. Update policies usually need both.

Is the service role affected?

No. The service role bypasses RLS, so never expose its key to the browser.

// DEVELOPER TOOL

Supabase RLS policy builder

Generate row-level security policies for Supabase and Postgres: public, signed-in, owner-only, team and admin access, with the indexes and explanations.

Free
No sign-up
Private: runs in your browser

// HOW IT WORKS

4 steps, no sign-up.

Built and maintained by Ruchira Sachinthana. Spotted a bug or want a feature? Tell me.

01Enter your table name and the column that stores the owner's user id.
02Choose who may select, insert, update and delete rows.
03Review the generated SQL and the notes about each policy.
04Run it in the Supabase SQL editor, then test as a signed-out and a signed-in user.

Supabase RLS policy builder

4 steps, no sign-up.

Supabase RLS builder: questions, answered.

More free tools

Need a tool like this built for your team?