RLS sounds great until it isn't — PlanetScale

PostgreSQL's Row Level Security sounds like a clean way to enforce access control at the database layer, but the foot-guns, pooling incompatibilities, and performance traps often make it more trouble than it's worth.

RLS sounds great until it isn't Josh Brown [ @ 0ximjosh ] | April 30, 2026 When you leave your house, go to sleep, or go do work in the yard, you lock your door. Maybe you have a gate or fence you lock too. Without these, anyone can waltz into your house and snoop around. Row Level Security (RLS) can be attractive to developers for numerous reasons, but the foot-guns and gotchas in RLS often outweigh the benefits. You probably want to keep your doors locked. Friends and family: Managing access RLS for Postgres lets administrators define security policies in their database, instead of the appli

saved by

• Ray Arayilakath

related reading

• On benchmarking — PlanetScaleplanetscale.com
• We rebuilt the Kubernetes control loop on Postgres | Atlasflowatlasflow.com
• Row Level Security | Supabase Docssupabase.com
• The feedback loops behind Kubernetes — PlanetScaleplanetscale.com
• Making 768 servers look like 1 — PlanetScaleplanetscale.com
• An Overview of Distributed PostgreSQL... | Crunchy Data Blogcrunchydata.com
• PostgreSQL rocks, except when it blocks: Understanding locks - Citus Datacitusdata.com
• Nine ways to shoot yourself in the foot with PostgreSQLphilbooth.me
• Blog — PlanetScaleplanetscale.com
• The only scalable delete in Postgres is DROP TABLE — PlanetScaleplanetscale.com
• The startup's Postgres survival guidehatchet.run
• Against SQLscattered-thoughts.net