> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Row-level security reference

> RLS patterns, table configuration, and access evaluation order

## Table configuration patterns

### Owner-based access

```json theme={null}
{ "ownerColumn": "userId" }
```

Users access rows where `ownerColumn` matches their user ID.

### Organization-based access

```json theme={null}
{ "orgColumn": "orgId" }
```

Users access rows where `orgColumn` matches any of their organization memberships.

### Admin bypass

```json theme={null}
{
  "ownerColumn": "userId",
  "bypassScopes": { "read": "tasks:viewAll", "write": "tasks:editAll" }
}
```

Users with the specified scope bypass ownership restrictions.

### Group membership access

```json theme={null}
{
  "ownerColumn": "authorId",
  "groupAccess": [{
    "column": "teamId",
    "membershipTable": "TeamMember",
    "membershipColumn": "teamId",
    "scopes": { "read": "tasks:viewTeam", "write": "tasks:editTeam" }
  }]
}
```

Users with the required scope and group membership can access matching rows.

### Scope-gated access

```json theme={null}
{ "requiredScopes": { "read": "settings:view", "write": "settings:edit" } }
```

No owner — access is purely scope-based.

### Inherited access

```json theme={null}
{
  "accessVia": {
    "column": "taskId",
    "parentTable": "Task",
    "parentColumn": "id"
  }
}
```

Child entity inherits all access rules from the parent.

## Access evaluation order

1. Owner access (`ownerColumn` match)
2. Group membership access (scope + membership)
3. Bypass scopes (scope match)

## RLS context

Injected automatically into every `ctx.db` query:

| Field        | Description                          |
| ------------ | ------------------------------------ |
| `userId`     | Authenticated user's ID              |
| `role`       | User's assigned role                 |
| `userScopes` | User's permission scopes             |
| `userOrgIds` | Organization IDs the user belongs to |

## Pattern selection guide

| Question                      | Pattern            |
| ----------------------------- | ------------------ |
| Each row has an owner?        | `ownerColumn`      |
| Multi-tenant data?            | `orgColumn`        |
| Admins should see everything? | Add `bypassScopes` |
| Team/group access needed?     | Add `groupAccess`  |
| Shared resource, no owner?    | `requiredScopes`   |
| Child of another table?       | `accessVia`        |