Row-Level Security in PostgreSQL: Multi-Tenant Isolation You Can't Forget

A complete guide to moving the tenant filter out of your code and into PostgreSQL with Row-Level Security: why the app must never connect as the table owner, ENABLE vs FORCE, RESTRICTIVE policies as a guardrail beneath permissive ones, USING vs WITH CHECK, and how to propagate the tenant with transactional set_config so it never leaks across pooled requests (the PgBouncer transaction-mode failure nobody reproduces locally). Includes the InitPlan trick — wrapping the context function in (SELECT ...) — that turns a Seq Scan with a per-row function call into an Index Cond, indexes led by tenant_id, policies that query other tables without infinite recursion, and the back doors that undo everything: views without security_invoker, SECURITY DEFINER functions, materialized views, COPY FROM and pg_dump. It also covers the covert channels in referential integrity (unique indexes that reveal other tenants rows, foreign keys that cross tenants) and the structural defence of composite FKs, isolation tests in pytest, the catalog test that breaks the build when someone adds a table without RLS, eight recurring mistakes, a production checklist and an FAQ. With production-ready SQL, Python and TypeScript.