row_security — PostgreSQL configuration parameter

This variable controls whether to raise an error in lieu of applying a row security policy.

At a glance

What it does

This variable controls whether to raise an error in lieu of applying a row security policy. When set to on, policies apply normally. When set to off, queries fail which would otherwise apply at least one policy. The default is on. Change to off where limited row visibility could cause incorrect results; for example, pg_dump makes that change by default. This variable has no effect on roles which bypass every row security policy, to wit, superusers and roles with the BYPASSRLS attribute.

For more information on row security policies, see createpolicy.

(Description quoted from the official PostgreSQL documentation.)

How to apply a change

Can be set per session with SET, per role/database with ALTER ROLE/DATABASE ... SET, or globally in postgresql.conf.

Inspect the current value and source with SHOW row_security; or SELECT name, setting, unit, context, source FROM pg_settings WHERE name = 'row_security';.

Tuning guidance

This sets a session default (locale, formatting, search path or transaction behaviour) rather than a performance knob. Set it per role or database with ALTER ROLE/DATABASE ... SET so the right default follows the right workload, and prefer setting it explicitly in the application for behaviour the query results depend on.

Reference

PostgreSQL documentation — row_security.