Policies are objects that handle the row-level security system introduced by PostgreSQL 10. The row-level security must be enabled in the table which will receive a policy so this object can be applied to the first. A policy grants the permission to select, insert, update, or delete rows that match the relevant policy expression. Existing table rows are checked against the expression specified in
USING, while new rows that would be created via
UPDATE are checked against the expression specified in
WITH CHECK. Policies can be applied for specific SQL commands or for specific roles. The following image and table show the policy object attributes.
|The command to which the policy applies. Possible values are
|This option creates a permissive policy when checked. A permissive policy has its expressions combined with other policies' expressions using OR operator when validating a certain query over the table. When not checked this option creates a restrictive policy that uses the AND operator during the validation of a query against a table.
|The roles to which the policy is applied. Leaving this field empty creates a policy that is applied to all roles (
|This tab stores the expressions that constrain operations on the table. There are two expression types:
USING expression (returning a boolean result) will be added to queries that refer to the table making rows that match that expression visible.
CHECK expression (also returning a boolean result) will be in
UPDATE queries executed against the table and only rows for which the expression evaluates to true will be allowed. Different from
USING expression the
CHECK is evaluated against the new contents of the row, not the current one.