All packsMulti-Tenant Auth & RBAC CoreSolve
postgres rls using policy without with check cross tenant insert
A USING policy blocks reads but not cross-tenant inserts
A row-level security policy without a WITH CHECK clause correctly filters SELECTs but still lets a request INSERT rows into another tenant's org.
This is one of the things Multi-Tenant Auth & RBAC Core already handles. Sign-in, organisations, invites and roles — with one customer's data provably unable to reach another's.
Is this you?
A Postgres RLS policy's USING clause governs which existing rows a query can see or touch (SELECT, UPDATE, DELETE) -- it says nothing about which rows a new INSERT is allowed to create. A policy written with only a USING clause correctly blocks tenant A from reading tenant B's rows, and still lets tenant A insert a row claiming to belong to tenant B's org_id.
Why this one is easy to get wrong
USING reads as "the rule for this table" in the CREATE POLICY syntax, and a policy that filters reads correctly passes every test that checks whether cross-tenant data is visible -- the insert path is a separate, easy-to-forget clause (WITH CHECK) that most RLS tutorials mention once and most generated policies omit, because the SQL still runs without it.
What you get instead
Every INSERT/UPDATE policy in the pack's frozen migration carries an explicit WITH CHECK (org_id = app.current_org_id() AND ...) alongside its USING clause -- separate policies per command, not one combined policy, specifically so a write path can't rely on a read-oriented rule that was never designed to gate it. A cross-tenant write attempt fails with 42501, and the verify suite's isolation tests probe writes directly, not just reads.
Source: ARCHITECTURE.md core decision 7, 'Traps this pack pre-empts' — checkable in the pack you receive
How you actually use this
You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.
Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.
Typical build: about 12 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.
Why you can believe this
2 of 3 runs passedWe ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →