3.7. Policies

Policies are objects that handle the row-level security system introduced by PostgreSQL 10. Row-level security must be enabled in the table that will receive a policy, so that the policy can be applied to it. A policy grants the permission to select, insert, update, or delete rows that match the relevant policy expression. Existing table rows are checked against the expression specified in USING, while new rows that would be created via INSERT or UPDATE are checked against the expression specified in WITH CHECK. Policies can be applied to specific SQL commands or to specific roles. The following image and table show the policy object attributes.

12

General
#	Field	Description
1	Command	The command to which the policy applies. The possible values are ALL, SELECT, INSERT, UPDATE, and DELETE.
2	Mode	Specifies the kind of policy. A Permissive policy has its expressions combined with other policies' expressions using the OR operator when validating a query over the table. A Restrictive policy uses the AND operator instead.

1

Roles
#	Field	Description
1	Roles	The roles to which the policy is applied. Leaving the list empty creates a policy that is applied to all roles (PUBLIC).

12

Expressions
#	Field	Description
1	USING	A boolean expression added to the queries that refer to the table. Rows that match it are the ones made visible (USING).
2	CHECK	A boolean expression applied to INSERT and UPDATE commands. Only the rows for which it evaluates to true are allowed (WITH CHECK). Unlike USING, it is evaluated against the new contents of the row.

References

Policy DDL
https://www.postgresql.org/docs/current/static/sql-createpolicy.html