KF2 — exemption independence [FO] (deterministic, no DB read).
THE §5.5 regression, pinned live: a principal EXEMPT from role RLS (the run's context user
holds a role with a filter-less permission row on the entity — precisely the service-
account/admin shape that holds real API keys) with a key binding must get a NON-EMPTY
effective clause containing the key filter. v1's design folded the key filter into the
role method AFTER its exemption early-return, which drops it for exactly these principals
while passing every narrow-role test — this check is the one that would have caught it.
KF2 — exemption independence [FO] (deterministic, no DB read). THE §5.5 regression, pinned live: a principal EXEMPT from role RLS (the run's context user holds a role with a filter-less permission row on the entity — precisely the service- account/admin shape that holds real API keys) with a key binding must get a NON-EMPTY effective clause containing the key filter. v1's design folded the key filter into the role method AFTER its exemption early-return, which drops it for exactly these principals while passing every narrow-role test — this check is the one that would have caught it.