The RLS-protected entity both users can Read but with different effective predicates.
OptionalLiveA single non-exempt (user, entity) pair — a user with a NON-empty effective Read clause
for that entity — for the live-RunView scoping check (RLS5). Present independently of the
two-user Usable flag (needs only one non-exempt user). Undefined ⇒ RLS5 skips-as-pass.
OptionalReasonWhy the fixture is unusable (for the skip note), when Usable is false.
OptionalSeededThe seeded no-grant test user (it-nogrant@integration.test, no roles) — has NO read permission on
MJ: AI Agent Runs, for the negative isolation check RLS10 (a user with no grant is served no rows).
Replaces the incidental reliance on anonymous@magic-link.local. Undefined ⇒ RLS10 skips-as-pass.
OptionalSeededThe two seeded, purpose-built RLS test users (it-rls-a@ / it-rls-b@integration.test), each in
ONLY the "Integration Test: RLS Scoped Reader" role — so both are genuinely scoped (non-exempt) on
MJ: AI Agent Runs. Resolved by email from the user cache. When present, the deterministic checks
RLS8/RLS9 exercise real multi-user isolation without depending on which pair discovery happens to
pick; undefined (seed not pushed) ⇒ those checks skip-as-pass.
OptionalSeededOptionalTokenA {{UserID}}-scoped RLS filter discovered from the provider's RowLevelSecurityFilters,
for the token-substitution (RLS1) and distinct-predicate-text (RLS2) checks. Present
independently of Usable — those checks only need a {{UserID}} filter (+ one or two
distinct users), NOT two divergent effective clauses. Undefined ⇒ those checks skip-as-pass.
True iff discovery found two distinct users with DIFFERENT non-empty Read RLS clauses.
First discovered non-exempt user.
Second discovered non-exempt user, with a DIFFERENT effective RLS clause than UserA.
Two users with DIFFERENT effective Row-Level-Security predicates for the same entity, DISCOVERED (never minted) from the provider's RLS filters + the user cache by the
rls-isolationbundle. Discovery has the safest possible teardown: nothing to delete. When the deployment has only RLS-exempt admins (no two users with distinct non-empty clauses),Usableis false and the RLS checks degrade gracefully (skip-as-pass with a logged note) rather than failing.