LAYER STANDARD
Authorization & RLS
Server-side permissions and row-level data policies
Classcritical
Why it mattersBrowser-hidden UI is presentation, not authorization. RLS is your last line of defense.
What this layer covers
Browser-hidden UI is presentation, not authorization. RLS is your last line of defense.
Production requirements
- Named owner responsible for this layer
- Preview environment ≠ production environment
- Configuration evidence (not just screenshots)
- Tested failure behavior
- Documented migration path
BY BUILDER
Implementation context
BUILDER
Lovable
Apply authorization & rls to Lovable.
Open file →BUILDERBolt.new
Apply authorization & rls to Bolt.new.
Open file →BUILDERReplit
Apply authorization & rls to Replit.
Open file →BUILDERv0
Apply authorization & rls to v0.
Open file →BUILDERBase44
Apply authorization & rls to Base44.
Open file →BUILDERCursor
Apply authorization & rls to Cursor.
Open file →