rowfenceAccess rules for Postgres

Write who can do what in one small file. rowfence compiles it into row-level security, and Postgres enforces it on every query.

Get started

Try it in the browser

Reference

One policy file

Relations read from your own columns and tables, permissions built from them, inherited down trees of folders or teams, and a rule for each table command.

Enforced by Postgres

Row-level security filters every read and checks every write. The app signs in each transaction and queries its tables as usual. A refused write says which rule and why.

Ships as migrations

Each change to the policy is a migration for the tool your app already uses (Alembic, Prisma, Drizzle Kit, SQL, goose, dbmate, Flyway). Any Postgres 16, 17 or 18. No extension, no superuser.

Tested like code

Tests next to the policy, invariants checked in many small worlds, and a review of each change that says who gains or loses access.

A small policy

authz

app role app_user                               -- the Postgres role the app connects as
type user = app.users
type folder = app.folders
  owner  : user   = owner_id                    -- a relation read from a column
  parent : folder = parent_id
  editor : user   = app.folder_editors(folder_id -> user_id)   -- ... or from a link table
  can edit = owner or editor or parent.edit     -- inherited down the tree
  can view = edit
rules app.folders
  select : view
  update : edit

The app says who is asking, then runs its usual queries:

sql

BEGIN;
SELECT authz.act_as('user', '42');
SELECT * FROM app.folders;                      -- only the folders 42 may view
UPDATE app.folders SET name = 'Plans' WHERE id = 7;   -- 0 rows unless 42 may edit folder 7
COMMIT;

The SDKs turn a write that changed nothing into a 404 (the row can't be seen) or a 403 that says which rule refused it and why.