Build the safeguards
Eight explained steps, a source example and a checkpoint at each decision.
Read the tutorialAPI security / PostgreSQL RLS / Identity
You’re signed in. Whose data is this?
A signed-in account requests another company’s document. A viewer attempts an edit. A developer forgets a filter. See which layer should stop each request.
The idea in plain language
Authentication establishes who is making a request. Authorization determines whether that identity may perform this action on this resource. A company boundary must survive a changed identifier and a forgotten query filter.
Invented sessions feed actual PostgreSQL row policies in your browser. The download adds a local HTTP adapter with opaque fixture sessions. Neither version is a production identity provider or a test of every database-privilege configuration.
Your independent testing environment
Make the failure visible.
Start with the cross-company document request. The broken handler returns Harbor’s record to an Orchard account; the safeguarded path returns no visible record. Then try the viewer, expired-session and omitted-filter cases.
An Orchard session requests document 22, which belongs to Harbor.
Ready. Choose an example and run both implementations.
Explain the result
The safe cross-company read returns 404 with no foreign rows. A viewer’s edit returns 403; an expired session returns 401. A list query without a tenant filter still returns only Orchard’s row under RLS.
Open the exact source behind this edition. The viewer checks each file against its SHA-256 manifest and explains the decision it implements.
Choose your next step
Compare the alternatives
Understand where each pattern helps and which tradeoffs remain.
Compare approachesRun and extend it locally
Download the independent environment, run the native checks and try a specific extension.
Open the how-to guideBefore you try it
Do I need to know how to code?
Start with Run and read the comparison. The tutorial introduces the code after you have seen the behavior. The how-to guide separates a no-install route from the native developer exercise.
What happens to the experiment when I reset?
Reset discards this lab’s temporary state and cancels or terminates its pending work. These examples use invented records. No account, production data or cloud deployment is needed.
What does the browser experiment establish?
Invented sessions feed actual PostgreSQL row policies in your browser. The download adds a local HTTP adapter with opaque fixture sessions. Neither version is a production identity provider or a test of every database-privilege configuration.