Concepts

fastapi-rls has three moving parts worth understanding before production:

• Policies — ORM-agnostic value objects that compile to PostgreSQL USING / WITH CHECK predicates.
• Request context & identity — how tenant_id / user_id reach the database connection, and why they can't leak between requests.
• Security model — the trust boundary, the non-superuser requirement, and what fastapi-rls does and does not protect against. Read it before you rely on the library in production.