Policies that look correct.

An insert policy that checks user_id = auth.uid() and never constrains organization_id. It reads correctly out loud, and it hands over an entire tenant in one statement.

Owner, admin, member — with the tenant as a required argument, so a policy that forgets it won't compile. Plus every escalation path between the ranks, and why some denials raise while others are silent.

Four holes in the policy everyone reaches for first, and the security definer function that closes them — claiming in one statement, refusing unverified email, and never becoming an enumeration oracle.

How "you may share what you can see" turns every recipient into a distributor, and how one expression reused across four policies lets a view-only grant quietly permit writes.

Authenticate, authorise, validate, act — in that order, because the moment an operation moves into a function, row-level security stops running. Plus the two defaults that turn a helper into a privilege escalation.