Access control is configured but lets everyone through
Permissive row level security policy
What this means
Row-level access control is switched on for this table, but the condition in the rule matches everybody. Your dashboard shows a green checkmark while the data is open to all.
Why it matters
This is more dangerous than having no protection at all: you believe everything is fine and stop looking. Automated checks that only verify a rule exists also report success.
When this is not a problem
For reference tables and public catalogues an open rule may be a deliberate choice.
How to fix it
- Check the condition in the access rule: it must compare the row's owner with the current user.
- Replace conditions that are always true.
Prompt for your AI agent
Fix the table's access policy: instead of a condition that matches everyone, compare the row owner with the current user.
How to verify the fix: sign in as a second account and query the first account's rows — expect nothing
References: cwe.mitre.org