RLS8 — DETERMINISTIC divergence on the seeded scoped users (no discovery guesswork).
The two purpose-built users (it-rls-a / it-rls-b), each in ONLY the scoped role, MUST get
DIFFERENT non-empty effective clauses on the seeded entity AND therefore different cache
fingerprints. This is RLS3's guarantee pinned to a known, version-controlled two-user scenario
so it runs on any DB the seed metadata was pushed to. Skips-as-pass when the seed is absent.
RLS8 — DETERMINISTIC divergence on the seeded scoped users (no discovery guesswork). The two purpose-built users (it-rls-a / it-rls-b), each in ONLY the scoped role, MUST get DIFFERENT non-empty effective clauses on the seeded entity AND therefore different cache fingerprints. This is RLS3's guarantee pinned to a known, version-controlled two-user scenario so it runs on any DB the seed metadata was pushed to. Skips-as-pass when the seed is absent.