supabase-policy-guardrails

name	supabase-policy-guardrails
description	Enforce organizational governance for Supabase projects: shared RLS policy library with reusable templates, table and column naming conventions, migration review process with CI checks, cost alert thresholds, and security audit scripts scanning for common misconfigurations. Use when establishing Supabase standards across teams, creating RLS policy templates, setting up migration review workflows, or auditing existing projects for security and cost issues. Trigger with phrases like "supabase governance", "supabase policy library", "supabase naming convention", "supabase migration review", "supabase cost alert", "supabase security audit", "supabase RLS template".
allowed-tools	Read, Write, Edit, Bash(supabase:*), Bash(psql:*), Bash(npx:*), Grep
version	1.53.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","supabase","governance","security","rls","naming-conventions","cost-management"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Supabase Policy Guardrails

Overview

Organizational governance for Supabase at scale: a shared RLS policy library (reusable templates for common access patterns), naming conventions (tables, columns, functions, policies), migration review process (CI checks ensuring RLS, preventing destructive operations, enforcing naming), cost alert configuration (billing thresholds and usage monitoring), and security audit scripts (scanning for exposed keys, missing RLS, overly permissive policies). All patterns use real createClient from @supabase/supabase-js and Supabase CLI commands.

Prerequisites

• Supabase project with supabase CLI installed and linked
• @supabase/supabase-js v2+ installed
• CI/CD pipeline (GitHub Actions recommended)
• Database access via psql or Supabase SQL Editor
• Pro plan recommended for cost alerts and usage API

Instructions

Step 1 — Shared RLS Policy Library and Naming Conventions

RLS Policy Templates

Create reusable RLS policy templates that teams apply to new tables. This prevents each developer from writing ad-hoc policies and ensures consistent access control.

-- supabase/migrations/00000000000000_rls_policy_library.sql
-- Shared RLS policy library — apply these templates to new tables

-- ============================================================
-- Template 1: Owner-only access (user owns the row)
-- Usage: tables with a user_id column (todos, profiles, settings)
-- ============================================================
CREATE OR REPLACE FUNCTION public.rls_owner_only(table_name text, user_column text DEFAULT 'user_id')
RETURNS void AS $$
BEGIN
  EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', table_name);

  EXECUTE format(
    'CREATE POLICY "owner_select" ON public.%I FOR SELECT USING (%I = auth.uid())',
    table_name, user_column
  );
   format(
    ,
    table_name, user_column
  );
   format(
    ,
    table_name, user_column
  );
   format(
    ,
    table_name, user_column
  );
;
$$  plpgsql;





  REPLACE  public.rls_org_scoped(
  table_name text,
  org_column text  ,
  allow_delete   
)
 void  $$

   format(, table_name);

   format(
    , table_name, org_column
  );
   format(
    , table_name, org_column
  );
   format(
    , table_name, org_column
  );

  IF allow_delete 
     format(
      , table_name, org_column
    );
   IF;
;
$$  plpgsql;





  REPLACE  public.rls_public_read_auth_write(
  table_name text,
  owner_column text  
)
 void  $$

   format(, table_name);

   format(
    ,
    table_name
  );
   format(
    ,
    table_name
  );
   format(
    ,
    table_name, owner_column
  );
   format(
    ,
    table_name, owner_column
  );
;
$$  plpgsql;