RF3 — API-key row filters keep the strict rules. The filter is referenced by an API-key scope
rule AND a role permission row on the same entity; a bad column must be refused by the
plain-column check and a subquery by the subquery ban — the role path must not loosen either.
RF3 — API-key row filters keep the strict rules. The filter is referenced by an API-key scope rule AND a role permission row on the same entity; a bad column must be refused by the plain-column check and a subquery by the subquery ban — the role path must not loosen either.