Audit Row-Level Security Policies with pg_policies

Mon, 31 Aug 2026 00:00:00 +0000

Audit Row-Level Security Policies with pg_policies

pg_policies turns a table's row-level security setup — however many CREATE POLICY statements are scattered across migration files — into one queryable inventory: one row per policy, with the roles it binds to, the command it governs, and the boolean expressions doing the actual filtering. A \d on the table shows that a policy exists; it does not show whether that policy is permissive or restrictive, which roles it actually applies to, or what its USING clause evaluates to at runtime. That gap between "a policy is attached" and "here is exactly what the policy does" is what an audit needs closed before trusting row-level security in production.

Row-Level Security on Postgres Scripts

Audit Row-Level Security Policies with pg_policies

Audit Row-Level Security Policies with pg_policies