Supabase RLS before launch

Treat browser-hidden UI as presentation, not authorization.

Implementation order

Assign an owner.
Separate preview and production.
Configure the smallest safe baseline.
Test expected and failure paths.
Document evidence and rollback.

Evidence standard

A builder-generated screen or successful demo is not proof. Verify the deployed configuration, a real non-admin user flow, alerts and recovery behavior.

Run readiness check →