🧱Row-Level Security

NEW

Also known as: RLS

A database security technique that restricts access to table rows based on user identity or context policies.

DESCRIPTION

Row-level security enforces fine-grained authorization, filtering rows at query time according to policies. Implementations exist in SQL Server, PostgreSQL, Snowflake, and BI tools. Policies can depend on user attributes, roles, or session context. RLS helps isolate tenants, protect sensitive records, and simplify application logic. Proper indexing, predicate design, and policy testing are essential to avoid performance and leakage issues.

ALTERNATIVE DEFINITIONS

Microsoft Learn

Row-level security (RLS) enables fine-grained access control over rows in a table, allowing you to restrict data access for given users.

Highlights fine-grained access control within SQL Server.

Source

PostgreSQL Documentation

Row security policies allow control over which rows are visible to which users.

Emphasizes policy mechanism integrated into PostgreSQL.

Source

Snowflake Documentation

Row access policies enable you to define filtering logic to determine which rows are visible to users based on attributes.

Adds attribute-based filtering in a cloud data warehouse.

Source

RELATED TERMS

RBAC Attribute-Based Access Control Policy-Based Access Control IAM Data Masking Access Control List Security Policy Database Security

COMPETING TERMS

Fine-Grained Access Control

RELATIONS

• Broader: Security

KNOWLEDGE AREAS

Data Security Data Management Data Architecture Data Storage & Operations

TARGET AUDIENCE

Data Engineer Analytics Engineer Data Steward Data Architect Cloud Architect BI Specialist Data Governance Manager

EXTERNAL SOURCES

• Wikipedia - Row-level security
• Microsoft - SQL Server RLS overview
• PostgreSQL - PostgreSQL row security policies
• Snowflake - Row access policies in Snowflake

TOP QUESTIONS

When should Row-Level Security be used?

Use RLS for multi-tenant isolation, protecting sensitive records, or enforcing contextual access without duplicating data structures.

Category: Requirements

How does Row-Level Security differ from Column-Level Security?

RLS filters rows based on policies, while column-level security restricts specific columns. They can be combined for stricter control.

Category: Alternatives

What are common performance pitfalls with Row-Level Security?

Complex predicates, missing indexes, and policy functions that don’t short-circuit cause slow queries and high CPU.

Category: Mistakes

How is Row-Level Security implemented in PostgreSQL?

Using CREATE POLICY with USING and WITH CHECK clauses, then enabling row security per table.

Category: Example

What is a risk of misconfigured Row-Level Security?

Policy gaps can expose unauthorized rows or block legitimate access, leading to data leaks or outages.

Category: Risks

How does Row-Level Security interact with ABAC?

RLS can evaluate user or session attributes, effectively implementing ABAC at the database tier.

Category: Example

Is Row-Level Security enforced in BI tools?

Many BI platforms support row-level filters, but enforcement is strongest when implemented at the database layer.

Category: Opinion

How do you test Row-Level Security policies?

Use role-specific sessions, policy unit tests, and sampling edge cases to validate visibility and performance.

Category: Management

Why is Row-Level Security still relevant?

It simplifies application logic and centralizes authorization, crucial for modern shared data platforms.

Category: Relevancy