Neon · Const

Neon RLS

Neon RLS uses PostgreSQL Row-Level Security to restrict table rows according to the authenticated user. Tables exposed through the Neon Data API must have RLS enabled and policies configured.

How it works

Neon RLS uses PostgreSQL row-level security to decide which rows a user may access. Enable RLS on each table exposed through the Data API, then define policies that use auth.user_id() to compare the row owner with the authenticated user.

Syntax

ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;
CREATE POLICY policy_name ON table_name USING (condition);

Key points

RLS applies authorization at row granularity, using the identity of the current user to decide access.
Client-side Data API queries require policies so users cannot access other users' rows.
Neon's Data API presents branch tables through REST endpoints, making database-level row protection part of the API security model.
Policies can use auth.user_id() as the authenticated user's identifier when evaluating row access.
Enable RLS on every table that the Data API can access rather than relying only on application-side filtering.

Common mistakes

Every table reachable through the Data API needs RLS enabled; enabling it without suitable policies can prevent intended access.
Testing with a table owner can hide policy problems because owners bypass RLS; use an appropriately restricted runtime role when validating behavior.

Example: Restrict rows to the authenticated user

-- Enable RLS and allow users to access only their own rows
ALTER TABLE notes ENABLE ROW LEVEL SECURITY;

CREATE POLICY notes_owner_policy ON notes
  USING (user_id = auth.user_id());

This enables RLS for notes and filters rows by the authenticated user's ID.

When to use it

Protect client-side table access

A browser or mobile client queries Neon through the Data API.

Enforce per-user ownership

Several users share a table but must see only their own records.

Apply database-level tenant isolation

A multi-tenant application stores tenant data in shared tables.

Interview questions

QWhat is Neon RLS?

RLS is PostgreSQL's per-row access-control feature. In Neon, policies determine which rows are available to the current user, and Data API tables must have RLS enabled.

Follow-up: What must be added after enabling RLS? Create policies that express the permitted access, commonly using auth.user_id() to match the row's owner.

QHow does a policy identify the current user?

The policy uses auth.user_id() to obtain the authenticated user's identifier and compares it with data in the row. Rows whose policy condition is not satisfied are not available through that policy.

Follow-up: How would you support multiple tenants? Store a tenant identifier on each protected row and write policy conditions that compare it with authenticated tenant context.

QWhy is RLS required for the Data API?

The Neon Data API exposes database tables through a REST interface, so its tables must be protected with PostgreSQL privileges and RLS policies. RLS controls which individual rows the user can access.

Follow-up: What should be checked if access is unexpectedly unrestricted? Verify that RLS is enabled, policies are present, and the connection does not use a role that bypasses RLS.

PostgreSQL Row-Level Security
Neon Data API
auth.user_id()
RLS policies

Source: Row-Level Security with Neon. Checked 2026-10-16.