---
title: "Row-Level Security (RLS)"
---

# Row-Level Security (RLS)

:::caution[SQL policies are planned]
In the stock Nano server, row-level security is enforced through the embedded
API and the REPL; SQL `CREATE POLICY` and enforcement for REST and wire clients
are planned. The current release rejects the policy statements on this page, which show
the planned syntax. To define policies today, use the Rust API or the REPL
`\tenant rls create` command: see the [RLS Quick Start](/docs/nano/guides/rls_quickstart/).
:::

Implement fine-grained access control at the row level for multi-tenant applications.

## Enabling RLS

```sql
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
```

## Creating Policies

### Basic Tenant Isolation

```sql
CREATE POLICY tenant_isolation ON orders
FOR ALL
USING (tenant_id = current_tenant_id());
```

### Read-Only Public Access

```sql
CREATE POLICY public_read ON products
FOR SELECT
TO PUBLIC
USING (published = true);
```

### Insert Validation

```sql
CREATE POLICY insert_own_data ON documents
FOR INSERT
WITH CHECK (owner_id = current_user_id());
```

## Policy Types

| Type | Description |
|------|-------------|
| `PERMISSIVE` | Multiple policies are OR'd together |
| `RESTRICTIVE` | Multiple policies are AND'd together |

## For All Operations

```sql
CREATE POLICY full_access ON accounts
FOR ALL
USING (owner_id = current_user_id())
WITH CHECK (owner_id = current_user_id());
```

## System Functions

| Function | Description |
|----------|-------------|
| `current_tenant_id()` | Current tenant ID |
| `current_tenant_name()` | Current tenant name |
| `current_user_id()` | Current user ID |

## View Policies

```sql
SELECT * FROM pg_rls_policies();
```

## REPL Commands

```bash
\tenant rls create orders policy_name "tenant_id = current_tenant_id()"
\tenant rls list orders
\tenant rls delete orders policy_name
```

## Disabling RLS

```sql
ALTER TABLE orders DISABLE ROW LEVEL SECURITY;
DROP POLICY policy_name ON orders;
```

## Related

- [Multi-Tenancy](https://www.heliosdb.com/docs/nano/features/multi-tenancy/) - Tenant management
- [SQL Reference](https://www.heliosdb.com/docs/nano/user-guide/sql-reference/) - Complete RLS syntax