Re: [HACKERS] RLS - permissive vs restrictive

2014-10-07 Thread Stephen Frost
* Robert Haas (robertmh...@gmail.com) wrote: > The key point from my angle is that if you grant user alice the right > to see records where a = 1 and user bob the right to see records where > a = 2, the multiple-policy approach allows those quals to be > implemented as index-scans. If you had a si

Re: [HACKERS] RLS - permissive vs restrictive

2014-10-07 Thread Robert Haas
On Tue, Oct 7, 2014 at 9:55 AM, Stephen Frost wrote: > ... or you could just only have one policy on the table and do whatever > you'd like with it (which was the original idea, actually, though I've > found myself very much liking the ability to have multiple policies, and > to have them set for

Re: [HACKERS] RLS - permissive vs restrictive

2014-10-07 Thread Stephen Frost
* Robert Haas (robertmh...@gmail.com) wrote: > On Tue, Oct 7, 2014 at 6:44 AM, Thom Brown wrote: > > It appears that I'm not the only person who finds it somewhat > > unintuitive for overlapping RLS policies to be permissive rather than > > restrictive (OR vs AND) (at least 3 others seem to expect

Re: [HACKERS] RLS - permissive vs restrictive

2014-10-07 Thread Robert Haas
On Tue, Oct 7, 2014 at 6:44 AM, Thom Brown wrote: > It appears that I'm not the only person who finds it somewhat > unintuitive for overlapping RLS policies to be permissive rather than > restrictive (OR vs AND) (at least 3 others seem to expect AND > behaviour), although I understand the reasonin

[HACKERS] RLS - permissive vs restrictive

2014-10-07 Thread Thom Brown
Hi, It appears that I'm not the only person who finds it somewhat unintuitive for overlapping RLS policies to be permissive rather than restrictive (OR vs AND) (at least 3 others seem to expect AND behaviour), although I understand the reasoning behind it. And I've since discovered that the same