Why every new table ships with RLS on

A table without row-level security is a public API. When the data layer is reachable from the browser, the only thing between a user's rows and the internet is a policy — so the policy has to exist before the first insert.

Every migration the agent writes creates the table, grants the minimum privileges the policies require, enables RLS, and then adds the policies, in that order. Skipping the grants is the most common failure in hand-written migrations.

Roles live in their own table, never on a profile row, and are read through a security-definer function. That one structural choice removes an entire class of privilege-escalation bugs.