All packsMulti-Tenant Auth & RBAC CoreSolve
postgres row level security silently disabled table owner
RLS does not bind the table owner -- and managed hosts default to it
Neon and Railway both hand you an owner connection string by default, and row-level security does not bind the table owner -- so RLS is silently a no-op.
This is one of the things Multi-Tenant Auth & RBAC Core already handles. Sign-in, organisations, invites and roles — with one customer's data provably unable to reach another's.
Is this you?
Postgres row-level security has one hard exception: the table owner bypasses it, always, regardless of any ENABLE or FORCE setting -- unless you specifically FORCE it and the owner isn't a superuser. If the application connects to the database as the owner role (the default connection string managed Postgres hosts hand you), every RLS policy silently does nothing, and the app appears to work correctly because the app's own WHERE clauses happen to filter correctly in every test anyone wrote.
Why this one is easy to get wrong
Neon and Railway both provision one connection string by default, and it's the owner. Nothing in the connection process warns that this role is exempt from the security feature you just wrote nineteen policies for -- the failure is invisible until a test specifically tries to read another tenant's data as this exact role, and most tenant-isolation test suites test through the app's own filtered queries, not by connecting directly as the app role and trying to break it.
What you get instead
The pack creates a dedicated app_user role (NOSUPERUSER NOBYPASSRLS, not the table owner) in a migration that runs separately from the app's own schema migrations, and the app refuses to boot if its own connection turns out to own a tenant table. The verify suite's iso-db-posture check asserts owner != current_user on the exact connection the app uses, so a regression here fails the build, not a security review.
Source: ARCHITECTURE.md core decision 8-9, 'Traps this pack pre-empts' — checkable in the pack you receive
How you actually use this
You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.
Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.
Typical build: about 12 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.
Why you can believe this
2 of 3 runs passedWe ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →