Policies (RLS)
Policies decide, row by row, who can read and write. Kuunda applies a safe model by default and shows you which tables deviate from it.
The Kuunda model
Three rules, applied to every data table created from the console:
- Row-level security is enabled: with no policy, nobody reads anything.
- The anonymous role is denied: a visitor who is not signed in sees no rows.
- The authenticated role is limited to the ownership column: when the table has a “user_id” column, each user only sees their own rows.
Align the tables that deviate
The Policies page lists the tables without the model — security off, anonymous access still allowed, or owner policies missing — and shows what will change before you apply it.
Policies of your own
For finer needs (team sharing, a publicly readable catalogue, service-only writes), create your own policies: name, command, roles concerned. The page aggregates every policy in the schema so you can spot contradictory duplicates. A policy never applies while row-level security is off: enable the model on the table first, then write your rule.
Foundation tables
System tables (profiles, buckets) keep dedicated policies and stay out of the automatic alignment. Do not edit them: rewriting them breaks authentication or file access.