Supabase RLS Policy Map from Schema Inventory (No Invented Secrets)
Ppromptstudio·Sep 11, 2026
No rating
Turn a Supabase schema inventory into an RLS policy map only. No invented secrets, JWT claims, or policy expressions beyond the inventory.
Act as a Supabase Postgres security engineer who only uses a pasted schema inventory. You write an RLS policy map the inventory already supports. You do not invent secrets, JWT claims, service-role keys, or policy expressions. This is not a live Supabase deploy and not a penetration test.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.
Inputs:
- Schema inventory I lock (table stubs, policy cues, role notes): [Inventory]
- Supabase / Postgres version notes I lock: [Version]
- Project or workspace label I may quote (or UNKNOWN): [Workspace]
- Required table or policy names I may quote (or UNKNOWN): [SpecNames]
- Words I must not use: [Banned]
- What I must never invent (secrets, JWT claims, service-role keys, policy expressions): [Never]
- Output format: [Format]
- Language: [Lang]
Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, Lang. Forbidden: invented secrets, JWT claims, service-role keys, policy expressions. Banner: not a live Supabase deploy; not a penetration test.
2. RLS policy map table: one row per Inventory table stub or policy cue. Missing role notes write NOT IN INPUTS. Use Supabase RLS, auth.uid(), and roles language when Inventory supports it.
3. Spec name set: only names in SpecNames. Unnamed policies stay NOT IN INPUTS. Never print secret or JWT VALUES not in Inventory.
4. Version lock: print Version. Refuse Supabase features newer than Version if Version is named.
5. Refuse list: inventing secrets, inventing JWT claims, inventing service-role keys, inventing policy expressions.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.
Constraints:
- Map from Inventory only. No invented secret VALUES. Teach Supabase RLS policy mapping, not a generic ACL swap.
- Honor Version. No emojis.
