How do I verify the fix?

The owner can read and write their rows. A second account gets nothing back for the first account’s rows. A request without a session is refused.

BUILD OS · AUTHORIZATION

Supabase returns “permission denied” or an empty list after enabling RLS

Short answer

Row level security denies by default: with RLS on and no policy allowing that operation for that role, Postgres refuses the query (or returns zero rows for SELECT). Write one owner-scoped policy per operation, add WITH CHECK for inserts and updates, and make sure the request carries the user’s session. Never fix it by disabling RLS.

Symptoms

“new row violates row-level security policy for table …” on insert.
“permission denied for table …” (42501).
A select that used to return data now returns an empty array.

Why this happens

Once RLS is enabled, every row access must be allowed by a policy that matches the operation and the requesting role. auth.uid() is null when the request has no session, so owner policies match nothing.

Most likely causes

No policy exists for this operation (e.g. SELECT exists, INSERT does not).
The INSERT/UPDATE policy lacks a WITH CHECK clause that the new row satisfies.
The owner column is null or filled from the wrong source on insert.
The request is made without the user session (anon key only).
The role is missing table privileges.

How to diagnose it

Note the exact operation and table from the error.
List the table’s policies for that operation in the Supabase dashboard.
Confirm the client sends the user session on that request.
For inserts, check that the owner column receives the signed-in user id.

Fix

Create least-privilege policies per operation, scoped to ownership or tenant membership.
Add WITH CHECK to insert and update policies.
Set the owner column server-side or with a database default, never from a free-form client field.
Keep the service-role key server-only, and authorize before using it.

Verify the fix

Do not close the issue until these checks pass in the environment that matters:

The owner can read and write their rows.
A second account gets nothing back for the first account’s rows.
A request without a session is refused.

Related Ship Passport checks

Build School’s production-readiness standard marks this area as proven only with evidence from these checks (it is Build School’s own standard, not an external certification):