Row Level Security (Postgres)

CREATE POLICY service_role_all ... TO service_role USING (true). Per-tenant policies for app-scope. service_role bypasses by default in Supabase. Pragmatic stance: enable RLS so Supabase Advisor stops warning, even if you also filter by tenant_id in app.