Row-level security reference

Table configuration patterns

Owner-based access

{ "ownerColumn": "userId" }

Users access rows where ownerColumn matches their user ID.

Organization-based access

{ "orgColumn": "orgId" }

Users access rows where orgColumn matches any of their organization memberships.

Admin bypass

{
  "ownerColumn": "userId",
  "bypassScopes": { "read": "tasks:viewAll", "write": "tasks:editAll" }
}

Users with the specified scope bypass ownership restrictions.

Group membership access

{
  "ownerColumn": "authorId",
  "groupAccess": [{
    "column": "teamId",
    "membershipTable": "TeamMember",
    "membershipColumn": "teamId",
    "scopes": { "read": "tasks:viewTeam", "write": "tasks:editTeam" }
  }]
}

Users with the required scope and group membership can access matching rows.

Scope-gated access

{ "requiredScopes": { "read": "settings:view", "write": "settings:edit" } }

No owner — access is purely scope-based.

Inherited access

{
  "accessVia": {
    "column": "taskId",
    "parentTable": "Task",
    "parentColumn": "id"
  }
}

Child entity inherits all access rules from the parent.

Access evaluation order

Owner access (ownerColumn match)
Group membership access (scope + membership)
Bypass scopes (scope match)

RLS context

Injected automatically into every ctx.db query:

Field	Description
`userId`	Authenticated user’s ID
`role`	User’s assigned role
`userScopes`	User’s permission scopes
`userOrgIds`	Organization IDs the user belongs to

Pattern selection guide

Question	Pattern
Each row has an owner?	`ownerColumn`
Multi-tenant data?	`orgColumn`
Admins should see everything?	Add `bypassScopes`
Team/group access needed?	Add `groupAccess`
Shared resource, no owner?	`requiredScopes`
Child of another table?	`accessVia`

Access control reference

Metrics reference

⌘I

Platform Docs

Synthetiq Desktop

Synthetiq CLI

App Framework

Services Framework

Workflows Framework

Platform API

Deployments

Row-level security reference

Table configuration patterns

Owner-based access

Organization-based access

Admin bypass

Group membership access

Scope-gated access

Inherited access

Access evaluation order

RLS context

Pattern selection guide

​Table configuration patterns

​Owner-based access

​Organization-based access

​Admin bypass

​Group membership access

​Scope-gated access

​Inherited access

​Access evaluation order

​RLS context

​Pattern selection guide

Table configuration patterns

Owner-based access

Organization-based access

Admin bypass

Group membership access

Scope-gated access

Inherited access

Access evaluation order

RLS context

Pattern selection guide