Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 39f2594

Browse files
committed
docs: Reword CREATE POLICY documentation.
1 parent 1e78d81 commit 39f2594

File tree

1 file changed

+12
-10
lines changed

1 file changed

+12
-10
lines changed

doc/src/sgml/ref/create_policy.sgml

+12-10
Original file line numberDiff line numberDiff line change
@@ -39,16 +39,18 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
3939
</para>
4040

4141
<para>
42-
A policy is an expression which is added to the security-barrier
43-
qualifications of queries which are run against the table the policy is on,
44-
or an expression which is added to the with-check options for a table and
45-
which is applied to rows which would be added to the table.
46-
The security-barrier qualifications will always be evaluated prior to any
47-
user-defined functions or user-provided WHERE clauses, while the with-check
48-
expression will be evaluated against the rows which are going to be added to
49-
the table. By adding policies to a table, a user can limit the rows which a
50-
given user can select, insert, update, or delete. This capability is also
51-
known as Row Level Security or RLS.
42+
A policy limits the ability to SELECT, INSERT, UPDATE, or DELETE rows
43+
in a table to those rows which match the relevant policy expression.
44+
Existing table rows are checked against the expression specified via
45+
USING, while new rows that would be created via INSERT or UPDATE are
46+
checked against the expression specified via WITH CHECK. Generally,
47+
the system will enforce filter conditions imposed using security
48+
policies prior to qualifications that appear in the query itself, in
49+
order to the prevent the inadvertent exposure of the protected data to
50+
user-defined functions which might not be trustworthy. However,
51+
functions and operators marked by the system (or the system
52+
administrator) as LEAKPROOF may be evaluated before policy
53+
expressions, as they are assumed to be trustworthy.
5254
</para>
5355

5456
<para>

0 commit comments

Comments
 (0)