# Is Postgres RLS for Everything and Everyone?

DevFeed: [Is Postgres RLS for Everything and Everyone?](<https://devfeed.tech/articles/is-postgres-rls-for-everything-and-everyone-5472.md>)

Original publisher: [Read original article](<https://neon.com/blog/is-postgres-rls-for-everything-and-everyone>)

Author: David Gomes

Published: 2024-11-15T17:32:58Z

Content type: article

Language: en

Sources: [Blog -- Neon Docs](<https://devfeed.tech/sources/blog-neon-docs.md>)

Topics: [Authorization](<https://devfeed.tech/topics/authorization.md>), [Multitenancy](<https://devfeed.tech/topics/multitenancy.md>), [Per-user Database](<https://devfeed.tech/topics/per-user-database.md>), [SQL](<https://devfeed.tech/topics/sql.md>), [Security](<https://devfeed.tech/topics/security.md>), [Drizzle](<https://devfeed.tech/topics/drizzle.md>), [Object-relational mapping](<https://devfeed.tech/topics/orm.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [database](<https://devfeed.tech/tags/database.md>), [drizzle](<https://devfeed.tech/tags/drizzle.md>), [multitenancy](<https://devfeed.tech/tags/multitenancy.md>), [orm](<https://devfeed.tech/tags/orm.md>), [postgres](<https://devfeed.tech/tags/postgres.md>), [security](<https://devfeed.tech/tags/security.md>), [sql](<https://devfeed.tech/tags/sql.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

The article examines whether PostgreSQL Row-Level Security (RLS) should express an application's entire authorization model. It recommends a project-per-user pattern for multitenancy when possible, while describing RLS as a way to prevent cross-tenant access in a shared database. It discusses RLS's dense syntax, recursion errors, policy behavior, security settings, optimizer considerations, and testing difficulties, and notes that Drizzle ORM can simplify some TypeScript usage.

## Source excerpt

In Neon, we recommend using a project-per-user pattern for multitenancy whenever possible. If this doesn't work for you and you're placing all your tenants within a single Postgres database, you should at least use RLS to prevent cross-tenant access--but expressing your entire aut...