Row-level security in plain English
Row-level security means every record decides who is allowed to read or write it, enforced on the server rather than trusted to the client. In SQL you write these rules as policies on each table, which is powerful and easy to get wrong. In Gemmein you do not write policies at all: you pick one of seven plain-English rules per collection, and the server enforces it.
Security decided per record, on the server.
Most access bugs come from checking permissions in the app, where a determined user can route around them. Row-level security moves the decision to the data itself: each record carries the rule for who may read or write it, and the server enforces that rule on every query. The client cannot ask for more than the rule allows.
Policies you write, and can get wrong.
In Postgres and tools built on it, row-level security is a set of policies you write per table in SQL: enable it, then define who can select, insert, update, and delete which rows. It is flexible and correct when done right. The risk is that it is yours to get right on every table, and a table with the feature left off, or a policy written too loosely, quietly returns rows it should not. The failure is silent, which is what makes it dangerous.
Pick a rule. The server does the rest.
Gemmein does not ask you to write policies. Every collection is governed by exactly one of seven plain-English rules, chosen when you create it and enforced on the server. There is nothing to enable and nothing to leave open, so you cannot misconfigure your way into a leak.
| Rule | What it means |
|---|---|
private | Each signed-in user sees and edits only their own records. |
shared | Every signed-in user reads every record and adds their own. |
admin_write | Everyone signed in can read. Only the owner can write. |
public_read | Readable without signing in. Only the app owner writes. |
community | Readable without signing in. Any signed-in user posts and edits their own. |
addressed | The owner creates records for one user. That user's list returns only their own, like an inbox. |
direct | Users send to each other. The owner can read them. |
// On a "private" collection, this returns only the signed-in user's rows.
const { records } = await g.collection("notes").list({ limit: 20 });Map the policy to a rule.
If you are used to writing RLS policies, the move is to stop writing them and choose the rule that matches your intent.
| The policy you would write | The Gemmein rule |
|---|---|
| A user can select and update only rows where user_id = auth.uid() | private |
| Everyone reads; a signed-in user writes their own rows | community or shared |
| Anyone reads; only the owner writes | public_read |
| Everyone signed in reads; only the owner writes | admin_write |
| Deliver one record to one specific user | addressed |
Give your agent the full task.
Building with Cursor, Claude, Bolt, or Lovable? Paste this so your agent picks the right rule instead of hand-rolling access checks.
Read https://docs.gemmein.com/llms.txt. I want row-level security for my app's data without writing SQL policies. Explain Gemmein's seven collection rules (private, shared, admin_write, public_read, community, addressed, direct) and, for each collection in my app, pick the rule that keeps each user's data correctly scoped. Show how a list query returns only what the rule allows.
npx gemmein devRead the getting-started guide Frequently asked questions.
Do I write SQL row-level security policies in Gemmein?
No. There is no SQL and no policy to write. You pick one of seven plain-English rules for each collection, and the server enforces it on every read and write.
Can row-level security be turned off or misconfigured?
No. Every collection has a rule, always on and enforced on the server. There is no switch to disable it and no policy to leave open, so you cannot misconfigure your way into a leak.
What if I need custom per-row conditions?
The seven rules cover the common cases. They are fixed. If your app needs arbitrary per-field policy logic beyond them, that is not something Gemmein exposes today.
I'm coming from Supabase RLS. How does it map?
A policy that lets a user see only their own rows maps to the private rule. Everyone reads, signed-in users write their own maps to community or shared. Public read with owner-only writes maps to public_read. You choose a rule instead of writing the policy.
Related.
Passwordless auth for an AI app · Auth and data on the product page · Gemmein vs Supabase for AI apps · Security
See if Gemmein fits your app.
Point your coding agent at docs.gemmein.com/llms.txt and ask it to confirm the fit before it builds.