Nice walkthrough. One thing worth adding to the missing-grant case: from Oct 30 2026, new tables in the public schema on existing projects get no default grants for anon/authenticated, so a brand-new table can return 42501 before any policy is even evaluated. The safe fix is explicit per-role GRANTs (e.g. grant select, insert on public.projects to authenticated) plus enable row level security and the policies in the same migration, rather than disabling RLS or a bulk "grant all on all tables".