Define and Audit Row Level Security Policies for GDPR Compliance
The Global Administrator is responsible for the RLS policy layer that enforces data access at the database level. Policies must be defined per table using Supabase's policy DSL, tied to auth.uid() for identity and custom JWT claims for role (coordinator, peer-mentor, global-admin) and organization context. This covers tables containing sensitive data including health information references, location data, financial reimbursement records, and encrypted assignment content. The admin must be able to verify policies are enforced and review policy definitions during compliance audits.
User Story
Acceptance Criteria
- Given a peer mentor user attempts to query another user's activities, when the SELECT query executes, then RLS returns zero rows without exposing the unauthorized data
- Given a coordinator queries activities, when RLS evaluates the policy, then only activities within their organization's scope are returned
- Given the global admin reviews RLS policies, when listing all policies via Supabase dashboard or CLI, then every table with sensitive data shows active RLS policies with documented policy definitions
- Given a user's JWT claims are updated (e.g., role change), when they make a subsequent database request, then the updated claims are evaluated by RLS immediately
- Given RLS is disabled on a table, when the admin runs a policy compliance check, then an alert is raised for any table containing personal data with RLS disabled
- Given a GDPR data access audit is requested, when the admin reviews policy logs, then access patterns per user/role are traceable through Supabase audit logging
Business Value
RLS policies are the primary technical control for GDPR compliance on this platform. The application handles health information (epikrise references for Blindeforbundet), location data, financial reimbursement records, and encrypted personal assignments. Without correct RLS, a single misconfigured query could expose sensitive data across organizational boundaries. This is explicitly non-negotiable given Norway's data protection requirements and the multi-organization nature of the platform.
Components
- Database Schema data
- Supabase Platform infrastructure