One database per tenant. Not one policy per table.

Postgres Row Level Security attaches policies to a table. Once enabled, every row a query returns or modifies must satisfy a policy expression, evaluated per row with the caller's role and session settings. Supabase builds on this: the client sends a JWT, Postgres exposes its claims through auth.uid() and auth.jwt(), and policies filter shared tables by tenant or user. See Supabase's RLS guide.

It works, and it has real advantages: one schema to migrate, one connection pool, cross-tenant analytics in a single query, and a mature Postgres you can use this afternoon. Enabling it is one statement. Many production systems run on it well.

The costs are structural. Authorization lives in SQL policies spread across every table, so correctness is the conjunction of all of them. A policy that is missing, or that references the wrong column, does not fail loudly; it returns other tenants' rows. Every new table must be remembered. Performance depends on the planner inlining the policy expression. And the blast radius of a mistake is the whole table, which is every tenant.