📄️ Configuration
Flask config keys for flask-rls: GUC prefix and naming, g-attribute keys, RLS_REQUIRE_CONTEXT strict mode, and debug logging.
📄️ Context
How Flask RLS sets the tenant and user context per transaction with set_config(), why it is safe under connection pooling, and how bypass() and override() scopes change context resolution.
📄️ Policies
Flask RLS policy classes — TenantPolicy, UserPolicy, ExpressionPolicy, CustomPolicy — plus the InitPlan performance pattern and the owner-bypass gotcha every RLS deployment must handle.
📄️ Alembic migrations
Manage PostgreSQL RLS as first-class Alembic migration steps with op.enable_rls, op.force_rls, op.create_policy, and friends — including reversibility rules.
📄️ Testing
How to test PostgreSQL RLS policies: run as a non-owner role, drive context with override(), and assert isolation, fail-closed behavior, and pool safety against a real database.
📄️ Migrating an Existing App to RLS
Adopt PostgreSQL Row-Level Security in an existing Flask app incrementally — from manual tenant_id filtering to database-enforced isolation, table by table, with verification and a rollback plan.