Ten days ago I wrote that the Postgres role which runs your migrations bypasses every row-level security policy you wrote. Mads Hansen replied with the obvious next step, and it was better than the article: run the same cross-tenant query suite twice, once as the serving role and once as the owner role, and compare.
I did. It works, and I published the assertion. Then Marco took it apart with one question: what happens if you remove the violating state from the fixture? I measured that too, and it caught my own advice out. Equality is green in four databases out of five, and three of them are broken.
So this is both halves. If you only take the first one home, you get a test that is green on a database with row-level security switched off.
The invariant is not "the owner run must fail"
My first instinct was to assert that the owner run leaks: it sees rows from other tenants, so the assertion is assertNotSame. That assertion is wrong, and it goes red on the day someone applies the correct fix.
