AppsSecurity & Compliance

Data protection

Row-level security (RLS)

Autessa row-level security (RLS) uses AutessaDB roles to decide which rows each caller sees. A role is assigned to people, teams, company roles, everyone at the company, app visitors or API keys, and its row rule uses placeholders such as $CURRENT_USER_ID and $CURRENT_USER_TEAMS, so one rule works for everyone, in the app, the API, agents and scripts alike.

Start free
AutessaDB role · Regional managerstable: accountsSample
ROW RULE
region IN $CURRENT_USER_TEAMS
writeCheck: SAME_AS_READ
Assigned toTeam · West, Team · East
Closed by default (rlsEnforced)On
Default role for new granteesRegional managers

Ana · team West

312 rows

No matching role

0 rows

The problem

What problem does it solve?

Most teams protect data by building separate tables or separate apps per audience. That multiplies copies and still leaks when an agent or an integration reads the table directly.

How it works

  1. 1

    Create a role

    Name it and add a table policy with a row rule in the same shape as a query’s WHERE groups.

  2. 2

    Use placeholders

    $CURRENT_USER_ID, $CURRENT_USER_EMAIL, $CURRENT_USER_TEAMS, $CURRENT_USER_ROLES and the app-visitor placeholders resolve to the acting identity at query time.

  3. 3

    Set an edit check

    NONE, SAME_AS_READ (the builder default, so nobody can move a row out of what they may see) or CUSTOM with its own write rule.

  4. 4

    Close the table

    Turn on rlsEnforced and an identity with no matching role sees no rows. Set a default role for new grantees.

Every option

Row-level security (RLS): settings and options

SettingWhat it does
Assign toUSER, TEAM, COMPANY_ROLE, COMPANY, CUSTOM_APP or API_KEY.
Row ruleWHERE groups combined with AND or OR. Null means all rows.
writeCheckNONE, SAME_AS_READ or CUSTOM (writePredicate).
rlsEnforcedClosed by default when on. Off: tables without policies are unrestricted.
Default roleAuto-assigned to new grantees when the table is shared. Required before broadening sharing on an enforced table.
Several rolesA caller covered by several roles sees the union of what they allow.

Permissions

Who can do what?

WhoWhat they can do
Admins of every table a role touchesCreate or change that role.
Table owner or ADMINTurn rlsEnforced on or off and set the default role.
Everyone elseSees only the rows their roles allow, wherever they query from.

FOR DEVELOPERS

How to manage security · CLIbash
autessa autessadb roles list
autessa autessadb roles create --json '{...}'
autessa autessadb tables update-settings --tableId ayXduiaLeFKh --json '{"rlsEnforced":true}'

What to know

  • Without rlsEnforced, table security is default-open: a table with no role rules is fully visible.
  • A placeholder the caller cannot fill matches no rows.
  • Inserts must fall inside what the caller can see; adding a row the caller’s own rules would hide is refused.

Read the docs: Row and column security →

Connections

How Row-level security (RLS) connects to the rest of Autessa

Column-level security and masking →

Roles also carry column rules.

Scoped API keys →

A key with its own role sees only what its role and its owner both allow.

AutessaDB →

The tables these rules protect.

Reports, policies and security questionnaires are on the Autessa Trust Center.

FAQ

Row-level security (RLS): questions

Does row-level security apply to AI agents?

Yes. Every request, whether from a person, tool, agent, script, app or API key, is evaluated against the roles of whoever it acts as.

Can one rule work for every salesperson?

Yes. Use a placeholder, such as owner_email = $CURRENT_USER_EMAIL, and each person sees their own rows.

What does closed by default mean?

With rlsEnforced on, an identity with no applicable role policy sees no rows at all, instead of all rows.

Can someone edit a row so it moves into another team’s view?

Not with SAME_AS_READ, the builder default. Updates must keep the row inside what the person can see.

Get started with Row-level security (RLS)

Autessa includes row-level security: AutessaDB roles filter which rows each person, app visitor or API key sees, with placeholders like $CURRENT_USER_TEAMS so one rule works for everyone.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours