▚ sandboxmax

Supabase RLS Policy Builder

Row-level security is the difference between a Supabase app and an open database — and theCREATE POLICY syntax is easy to get subtly wrong. Pick your table, operation, and role, choose an ownership preset (or write custom clauses), and copy syntax-valid PostgreSQL. The builder enforces the real validity rules: INSERT policies take only WITH CHECK, SELECT and DELETE take only USING.

runs 100% in your browser — schema details never leave the tab

  1. 1Describe the accessTable name, operation (ALL / SELECT / INSERT / UPDATE / DELETE), and the Supabase role it applies to.
  2. 2Pick a preset or go custom"User owns record", read-everyone/update-owner, or team matching — or type your own USING and WITH CHECK clauses.
  3. 3Copy valid SQLThe policy updates as you click, with the clause rules Postgres actually enforces baked in.

Clause validity is enforced automatically: INSERT policies emit onlyWITH CHECK; SELECT andDELETE emit only USING — exactly what Postgres accepts.

Generated PostgreSQL

Run it in the Supabase SQL editor. The ALTER TABLE … ENABLE ROW LEVEL SECURITYline is included — without it, policies exist but nothing is enforced.
Is it safe to paste sensitive data into the Supabase RLS Policy Builder?
Yes. The Supabase RLS Policy Builder runs 100% client-side inside your browser thread — nothing you paste is uploaded, logged, or transmitted. SandboxMax is a static site with no backend server, no cookies, and no trackers: open your browser's network panel while you work and you'll see zero requests leave the tab.