What is Policy?

One rule in Row Level Security, such as 'people can read only their own orders'.

Where Policy goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 5 minutes · Pro
The table anyone can read
Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
Why can anyone read my Supabase table?
Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Read the fix
AI inside your app · 4 minutes · Pro
The refund policy it made up
A customer wants the 60-day refund your support bot promised them. Your policy is 14 days. They have a screenshot.
How do I stop my chatbot making things up?
Give it your real documents with each question and tell it to answer only from them, saying it doesn't know and offering a human when they don't cover the question. Link the source so customers can check. Keep refunds, prices and other commitments with people or code, because customers and courts treat your bot's words as yours.
Read the fix
Accounts and privacy · 4 minutes · Pro
Customer data in the prompt
Your new AI support summary sends every support conversation, with names, emails and order details, to an AI provider. A customer asks where their data goes.
Can I send customer data to an AI API?
You can, but it means sharing personal data with another company, so your privacy policy and agreements must cover it. Send only what the feature needs, removing names, emails and payment details first. Use a plan or setting that doesn't train on or retain your data longer than needed, accept the provider's data processing agreement, and list the provider.
Read the fix
Teams and sharing · 4 minutes · Free
Removed, but still inside
You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.
Why can a removed user still access data?
If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.
Walk it, free
Who may see what · 4 minutes · Pro
The bucket of ID photos
Users upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.
Are files in my storage bucket private?
Only if the bucket is private and its policies restrict access. A public bucket serves every file to anyone with the address, however secure your database is. Store private files in a private bucket, have the server create short-lived signed links for the right user, and delete sensitive files once you no longer need them.
Read the fix
Who may see what · 4 minutes · Pro
Permission denied for table
Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.
Why does Supabase say permission denied for table?
The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.
Read the fix

Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Authorization: Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.
Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Supabase: A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.

All 62 terms in the glossary

Where Policy goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 5 minutes · Pro

The table anyone can read

Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

Why can anyone read my Supabase table?

Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

Read the fix

AI inside your app · 4 minutes · Pro

The refund policy it made up

A customer wants the 60-day refund your support bot promised them. Your policy is 14 days. They have a screenshot.

How do I stop my chatbot making things up?

Give it your real documents with each question and tell it to answer only from them, saying it doesn't know and offering a human when they don't cover the question. Link the source so customers can check. Keep refunds, prices and other commitments with people or code, because customers and courts treat your bot's words as yours.

Read the fix

Accounts and privacy · 4 minutes · Pro

Customer data in the prompt

Your new AI support summary sends every support conversation, with names, emails and order details, to an AI provider. A customer asks where their data goes.

Can I send customer data to an AI API?

You can, but it means sharing personal data with another company, so your privacy policy and agreements must cover it. Send only what the feature needs, removing names, emails and payment details first. Use a plan or setting that doesn't train on or retain your data longer than needed, accept the provider's data processing agreement, and list the provider.

Read the fix

Teams and sharing · 4 minutes · Free

Removed, but still inside

You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.

Why can a removed user still access data?

If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.

Walk it, free

Who may see what · 4 minutes · Pro

The bucket of ID photos

Users upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.

Are files in my storage bucket private?

Only if the bucket is private and its policies restrict access. A public bucket serves every file to anyone with the address, however secure your database is. Store private files in a private bucket, have the server create short-lived signed links for the right user, and delete sensitive files once you no longer need them.

Read the fix

Who may see what · 4 minutes · Pro

Permission denied for table

Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Why does Supabase say permission denied for table?

The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.

Read the fix

Related terms

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Authorization

Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Supabase

A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.