@@ -39,16 +39,18 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
39
39
</para>
40
40
41
41
<para>
42
- A policy is an expression which is added to the security-barrier
43
- qualifications of queries which are run against the table the policy is on,
44
- or an expression which is added to the with-check options for a table and
45
- which is applied to rows which would be added to the table.
46
- The security-barrier qualifications will always be evaluated prior to any
47
- user-defined functions or user-provided WHERE clauses, while the with-check
48
- expression will be evaluated against the rows which are going to be added to
49
- the table. By adding policies to a table, a user can limit the rows which a
50
- given user can select, insert, update, or delete. This capability is also
51
- known as Row Level Security or RLS.
42
+ A policy limits the ability to SELECT, INSERT, UPDATE, or DELETE rows
43
+ in a table to those rows which match the relevant policy expression.
44
+ Existing table rows are checked against the expression specified via
45
+ USING, while new rows that would be created via INSERT or UPDATE are
46
+ checked against the expression specified via WITH CHECK. Generally,
47
+ the system will enforce filter conditions imposed using security
48
+ policies prior to qualifications that appear in the query itself, in
49
+ order to the prevent the inadvertent exposure of the protected data to
50
+ user-defined functions which might not be trustworthy. However,
51
+ functions and operators marked by the system (or the system
52
+ administrator) as LEAKPROOF may be evaluated before policy
53
+ expressions, as they are assumed to be trustworthy.
52
54
</para>
53
55
54
56
<para>
0 commit comments