Repair Supabase RLS Tenant Scope Regression

Repair Supabase RLS Tenant Scope Regression — EVIDENCE-LIMITED REVIEW

Scenario received

A policy change lets a support role query records outside its expected tenant scope.

Evidence inventory

• S1: RLS policies and grants — partial extract described by the requester; original full source not provided here.
• S2: JWT claim examples — partial extract described by the requester; original full source not provided here.
• S3: client query failure logs — NOT PROVIDED; required to validate dependent findings.
• S4: tenant isolation test fixtures — NOT PROVIDED; required to validate dependent findings.

Case-specific checks

Map effective role and claim combinations. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
2.

Check policy USING and WITH CHECK. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
3.

Test cross tenant negative access. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
4.

Isolate migrations that changed policy behavior. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.

Deliverables

Tenant authorization evidence matrix. Create an evidence-linked section with observations, missing data, owner and next validation step.

Minimum privilege policy patch. Create an evidence-linked section with observations, missing data, owner and next validation step.

Cross tenant regression tests. Create an evidence-linked section with observations, missing data, owner and next validation step.

Acceptance gate

The repair defaults to deny and never exposes confidential tenant records in examples. Do not label this gate passed until supplied source records actually demonstrate it.

Verdict and next action

INCOMPLETE — evidence required. Request S3 and S4 from the authorized owner, reconcile them with S1 and S2, then repeat the four checks and log remaining conflicts. No production change, approval, communication, or test run is claimed.