Strong post. RLS is the right answer for exactly the reason you give. A few production gotchas from my side. RLS doesn't apply to table owners or superusers, so the app role must not own the tables, and watch out for BYPASSRLS. The tenant context (e.g. SET app.current_tenant) has to be reset per checkout when you're behind PgBouncer. A leaked tenant setting is a data leak. And policy expressions run on every row, so keep them sargable and index-friendly on large tables or RLS becomes a performance tax. Miss any of those and the enforcement story quietly breaks.