RLS1 — {{UserID}} token substitution (deterministic, no DB read).
The per-user marked-up predicate MUST embed THAT user's id and leave no unsubstituted
token. This is the most basic guarantee the whole RLS mechanism rests on: if markup
failed, every scoped query would carry a broken predicate. Needs only a {{UserID}}
filter + the run's context user; skips-as-pass when no such filter exists.
RLS1 — {{UserID}} token substitution (deterministic, no DB read). The per-user marked-up predicate MUST embed THAT user's id and leave no unsubstituted token. This is the most basic guarantee the whole RLS mechanism rests on: if markup failed, every scoped query would carry a broken predicate. Needs only a
{{UserID}}filter + the run's context user; skips-as-pass when no such filter exists.