RLS on Every Table: Security as Product, Not Compliance
Row-level security (RLS) is a checkbox on most engineering roadmaps. It is required for SOC 2, mentioned in security questionnaires, implemented once and forgotten. At Olmex, RLS is not compliance. It is a product principle that shapes every architectural decision.
The Permission Boundary
Olmex's core promise is synthesis across systems. This requires reading data from Jira, GitHub, Slack, Google Calendar — systems with their own permission models. The product must never reveal information to a user that the source systems would not show them.
This is harder than it sounds. Document-level filtering is solved: if a user cannot access a Jira ticket, the product does not show it. But synthesis-level safety is not solved. If the product tells a manager "hiring plans changed yesterday" based on a document they cannot access, it has leaked without quoting a word. The presence of the item in the brief reveals existence.
RLS on every table is the foundation, not the ceiling. The ceiling is permission propagation through every graph traversal, every ranking step, every aggregation path. The product must check visibility at every layer: can this user see the signals that support this claim? Can they see the entities this claim references? Can they see the room this brief is delivered to?
The Lockstep Discipline
Every API-side condition has a corresponding migration SQL, asserted verbatim in a test. Every new table ships with RLS policies copying the existing pattern. Every new endpoint that accepts a reference to content verifies via memberContext()/can() that the caller can see the target before accepting the write.
This is not bureaucratic. It is structural. A single cross-tenant read is a sev-1 incident. A single synthesis leak destroys trust in the product's core value proposition. The discipline of RLS is the discipline of trust.
The Test That Must Pass
Every new table gets a CI test that attempts a cross-tenant read and must fail. Every new surface gets a visibility test: one synthetic workspace with a known room/role matrix, every surface rendered as every synthetic member, assert zero invisible content and zero existence leaks.
This test blocks CI. It is not a manual check. It is not a quarterly audit. It is a gate that every commit must pass.
None of the four requirements in The Olmex Standard matter if the product leaks what a user should not see while meeting them.
The Honest Position
Olmex is built for founders who trust the product with their company's most sensitive information: hiring plans, financial discussions, strategic decisions, team conflicts. This trust is not earned by marketing. It is earned by architecture: RLS on every table, permission checks on every query, visibility tests on every surface.
Security as product means the security model is not a layer added after the fact. It is the foundation on which everything else is built. The founder who reads their brief does not think about RLS. But they trust the product because someone did.