# Row-level security production checklist: test every path before launch

A row-level security production checklist should prove more than “RLS is enabled.” A production database needs the right grants, policies for each operation, tests for allowed and denied paths, safe handling of views and functions, and a review process that catches a missing tenant boundary before launch.

Supabase’s [Row Level Security guide](https://supabase.com/docs/guides/database/postgres/row-level-security) makes the key point clearly: grants and policies work together. A policy narrows which rows an operation can affect, but adding a policy does not remove an overly broad table grant. Start with the access model, then verify the database behavior with a role that matches the application request.

---

*This is an excerpt. Read the full post at [otf-kit.dev/blog/supabase-rls-production-checklist](https://otf-kit.dev/blog/supabase-rls-production-checklist) — full-stack kits your AI coding agent can actually ship to production. [Browse the kits →](https://otf-kit.dev)*