CREATE_POLICY(7pg14)

💅 CREATE_POLICY(7) 💅

✨ NAME ✨

Okay bestie, this is the CREATE_POLICY(7) page from the PostgreSQL 14.24 docs, and it's literally about how to define a new row-level security policy for a table. Security glow-up, no cap. 🫶

🫶 SYNOPSIS 🫶

CREATE POLICY name ON table_name
    [ AS { PERMISSIVE | RESTRICTIVE } ]
    [ FOR { ALL | SELECT | INSERT | UPDATE | DELETE } ]
    [ TO { role_name | PUBLIC | CURRENT_ROLE | CURRENT_USER | SESSION_USER } [, ...] ]
    [ USING ( using_expression ) ]
    [ WITH CHECK ( check_expression ) ]

💖 DESCRIPTION 💖

So the CREATE POLICY command defines a shiny new row-level security policy for a table. But heads up: row-level security has to be enabled on the table first — you do that with ALTER TABLE ... ENABLE ROW LEVEL SECURITY — otherwise the policies you create just sit there and don't get applied. Important detail, bestie. ✨

A policy grants permission to select, insert, update, or delete rows that match the relevant policy expression. Existing table rows are checked against the expression in USING, while new rows that would be created via INSERT or UPDATE are checked against the expression in WITH CHECK. When a USING expression returns true for a given row, that row is visible to the user; if it returns false or null, the row is not visible. Typically no error occurs when a row is not visible, but see Table 281 for exceptions. When a WITH CHECK expression returns true for a row, that row is inserted or updated; if it returns false or null, an error occurs. 😭

For INSERT and UPDATE statements, WITH CHECK expressions are enforced after BEFORE triggers are fired, and before any actual data modifications are made. So a BEFORE ROW trigger may modify the data to be inserted, affecting the result of the security policy check. WITH CHECK expressions are enforced before any other constraints. Order matters, iykyk. 🔥

Policy names are per-table. Therefore, one policy name can be used for many different tables and have a definition for each table which is appropriate to that table. Reusable name, table-specific vibe. 🎀

Policies can be applied for specific commands or for specific roles. The default for newly created policies is that they apply for all commands and roles, unless otherwise specified. Multiple policies may apply to a single command; see below for more details. Table 281 summarizes how the different types of policy apply to specific commands. 📋

For policies that can have both USING and WITH CHECK expressions (ALL and UPDATE), if no WITH CHECK expression is defined, then the USING expression will be used both to determine which rows are visible (normal USING case) and which new rows will be allowed to be added (WITH CHECK case). Two jobs, one expression. 💅

If row-level security is enabled for a table, but no applicable policies exist, a “default deny” policy is assumed, so that no rows will be visible or updatable. No policy, no access. Periodt. 💀

🎀 PARAMETERS 🎀

name — the name of the policy to be created. This must be distinct from the name of any other policy for the table. No duplicate names for the same table, bestie.
table_name — the name (optionally schema-qualified) of the table the policy applies to.
PERMISSIVE — says the policy is to be created as a permissive policy. All permissive policies which are applicable to a given query will be combined together using the Boolean “OR” operator. By creating permissive policies, administrators can add to the set of records which can be accessed. Policies are permissive by default. OR energy: add access.
RESTRICTIVE — says the policy is to be created as a restrictive policy. All restrictive policies which are applicable to a given query will be combined together using the Boolean “AND” operator. By creating restrictive policies, administrators can reduce the set of records which can be accessed, as all restrictive policies must be passed for each record. AND energy: tighten access.

Note that there needs to be at least one permissive policy to grant access to records before restrictive policies can be usefully used to reduce that access. If only restrictive policies exist, then no records will be accessible. When a mix of permissive and restrictive policies are present, a record is only accessible if at least one of the permissive policies passes, in addition to all the restrictive policies. One permissive pass plus every restrictive pass, or it's a no. 🫶

command — the command to which the policy applies. Valid options are ALL, SELECT, INSERT, UPDATE, and DELETE. ALL is the default. See below for specifics regarding how these are applied.
role_name — the role(s) to which the policy is to be applied. The default is PUBLIC, which will apply the policy to all roles.
using_expression — any SQL conditional expression (returning boolean). The conditional expression cannot contain any aggregate or window functions. This expression will be added to queries that refer to the table if row-level security is enabled. Rows for which the expression returns true will be visible. Any rows for which the expression returns false or null will not be visible to the user (in a SELECT), and will not be available for modification (in an UPDATE or DELETE). Typically, such rows are silently suppressed; no error is reported (but see Table 281 for exceptions). Visible or invisible — that's the USING vibe check.
check_expression — any SQL conditional expression (returning boolean). The conditional expression cannot contain any aggregate or window functions. This expression will be used in INSERT and UPDATE queries against the table if row-level security is enabled. Only rows for which the expression evaluates to true will be allowed. An error will be thrown if the expression evaluates to false or null for any of the records inserted or any of the records that result from the update. Note that the check_expression is evaluated against the proposed new contents of the row, not the original contents. New row energy only — not the original row. 😭

💅 Per-Command Policies 💅

🔥 ALL 🔥

Using ALL for a policy means that it will apply to all commands, regardless of the type of command. If an ALL policy exists and more specific policies exist, then both the ALL policy and the more specific policy (or policies) will be applied. Additionally, ALL policies will be applied to both the selection side of a query and the modification side, using the USING expression for both cases if only a USING expression has been defined. Main character policy: applies everywhere. 👑

As an example, if an UPDATE is issued, then the ALL policy will be applicable both to what the UPDATE will be able to select as rows to be updated (applying the USING expression), and to the resulting updated rows, to check if they are permitted to be added to the table (applying the WITH CHECK expression, if defined, and the USING expression otherwise). If an INSERT or UPDATE command attempts to add rows to the table that do not pass the ALL policy's WITH CHECK expression (or its USING expression, if it does not have a WITH CHECK expression), the entire command will be aborted. Whole command aborted — not just the row. Dramatic but true. 💀

🌈 SELECT 🌈

Using SELECT for a policy means that it will apply to SELECT queries and whenever SELECT permissions are required on the relation the policy is defined for. The result is that only those records from the relation that pass the SELECT policy will be returned during a SELECT query, and that queries that require SELECT permissions, such as UPDATE and DELETE, will also only see those records that are allowed by the SELECT policy. A SELECT policy cannot have a WITH CHECK expression, as it only applies in cases where records are being retrieved from the relation, except as described below. Read-only policy, so no WITH CHECK except the exceptions below. 🦋

If a data-modifying query has a RETURNING clause, SELECT permissions are required on the relation, and any newly inserted or updated rows from the relation must satisfy the relation's SELECT policies in order to be available to the RETURNING clause. If a newly inserted or updated row does not satisfy the relation's SELECT policies, an error will be thrown (inserted or updated rows to be returned are never silently ignored). Never silently ignored, bestie. 😭

If an INSERT has an ON CONFLICT DO UPDATE clause, or an ON CONFLICT DO NOTHING clause with an arbiter index or constraint specification, then SELECT permissions are required on the relation, and the rows proposed for insertion are checked using the relation's SELECT policies. If a row proposed for insertion does not satisfy the relation's SELECT policies, an error is thrown (the INSERT is never silently avoided). In addition, if the UPDATE path is taken, the row to be updated and the new updated row are checked against the relation's SELECT policies, and an error is thrown if they are not satisfied (an auxiliary UPDATE is never silently avoided). No sneaky silent avoids. Not today. ✨

🦋 INSERT 🦋

Using INSERT for a policy means that it will apply to INSERT commands. Rows being inserted that do not pass this policy will result in a policy violation error, and the entire INSERT command will be aborted. An INSERT policy cannot have a USING expression, as it only applies in cases where records are being added to the relation. Adding rows only — so no USING. 🎀

Note that an INSERT with an ON CONFLICT DO NOTHING/UPDATE clause will check the INSERT policies' WITH CHECK expressions for all rows proposed for insertion, regardless of whether or not they end up being inserted. Proposed rows get checked even if they don't make it in. 💅

💜 UPDATE 💜

Using UPDATE for a policy means that it will apply to UPDATE, SELECT FOR UPDATE and SELECT FOR SHARE commands, as well as auxiliary ON CONFLICT DO UPDATE clauses of INSERT commands. Since UPDATE involves pulling an existing record and replacing it with a new modified record, UPDATE policies accept both a USING expression and a WITH CHECK expression. The USING expression determines which records the UPDATE command will see to operate against, while the WITH CHECK expression defines which modified rows are allowed to be stored back into the relation. USING picks the rows, WITH CHECK approves the glow-up. 🔥

Any rows whose updated values do not pass the WITH CHECK expression will cause an error, and the entire command will be aborted. If only a USING clause is specified, then that clause will be used for both USING and WITH CHECK cases. If the updated row fails, the whole command is done. 💀

Typically an UPDATE command also needs to read data from columns in the relation being updated (e.g., in a WHERE clause or a RETURNING clause, or in an expression on the right hand side of the SET clause). In this case, SELECT rights are also required on the relation being updated, and the appropriate SELECT or ALL policies will be applied in addition to the UPDATE policies. Thus the user must have access to the row(s) being updated through a SELECT or ALL policy in addition to being granted permission to update the row(s) via an UPDATE or ALL policy. Read access plus update access — both required, no shortcuts. 🫶

When an INSERT command has an auxiliary ON CONFLICT DO UPDATE clause and the UPDATE path actually gets taken, bestie, here's the order of operations: the row that's about to be updated gets checked against the USING expressions of any UPDATE policies first, and then the brand-new updated row gets checked against the WITH CHECK expressions. But — and this is the plot twist — unlike a standalone UPDATE command, if the existing row doesn't pass the USING expressions, an error gets thrown. The UPDATE path will never be silently avoided. No sneaky sidestep, no quiet exit. It just errors. 💀

DELETE

Using DELETE for a policy means it applies to DELETE commands, periodt. Only rows that pass this policy will be seen by a DELETE command. And yes, there can absolutely be rows that are visible through a SELECT policy but not available for deletion — that happens when they don't pass the USING expression for the DELETE policy. Awkward but true. 🙈

In most cases a DELETE command also needs to read data from columns in the relation it's deleting from (think: a WHERE clause, or a RETURNING clause). When that happens, SELECT rights are also required on the relation, and the appropriate SELECT or ALL policies get applied in addition to the DELETE policies. So basically the user needs access to the row(s) being deleted through a SELECT or ALL policy and needs permission to delete those row(s) via a DELETE or ALL policy. Both. Not one or the other. 💅

A DELETE policy cannot have a WITH CHECK expression — it only applies in cases where records are being deleted from the relation, so there's literally no new row to check. Nothing to look at. Empty chair. 🪑

Table 281 summarizes how the different types of policy apply to specific commands. In the table, “check” means the policy expression is checked and an error is thrown if it returns false or null, whereas “filter” means the row is silently ignored if the policy expression returns false or null.

Table 281. Policies Applied by Command Type

SELECT / COPY ... TO

SELECT/ALL policy, USING expression: Filter existing row
INSERT/ALL policy, WITH CHECK expression: —
UPDATE/ALL policy, USING expression: —
UPDATE/ALL policy, WITH CHECK expression: —
DELETE/ALL policy, USING expression: —

SELECT FOR UPDATE/SHARE

SELECT/ALL policy, USING expression: Filter existing row
INSERT/ALL policy, WITH CHECK expression: —
UPDATE/ALL policy, USING expression: Filter existing row
UPDATE/ALL policy, WITH CHECK expression: —
DELETE/ALL policy, USING expression: —

INSERT

SELECT/ALL policy, USING expression: Check new row [a]
INSERT/ALL policy, WITH CHECK expression: Check new row
UPDATE/ALL policy, USING expression: —
UPDATE/ALL policy, WITH CHECK expression: —
DELETE/ALL policy, USING expression: —

UPDATE

SELECT/ALL policy, USING expression: Filter existing row [a] & check new row [a]
INSERT/ALL policy, WITH CHECK expression: —
UPDATE/ALL policy, USING expression: Filter existing row
UPDATE/ALL policy, WITH CHECK expression: Check new row
DELETE/ALL policy, USING expression: —

DELETE

SELECT/ALL policy, USING expression: Filter existing row [a]
INSERT/ALL policy, WITH CHECK expression: —
UPDATE/ALL policy, USING expression: —
UPDATE/ALL policy, WITH CHECK expression: —
DELETE/ALL policy, USING expression: Filter existing row

INSERT ... ON CONFLICT

SELECT/ALL policy, USING expression: Check new row [b][c]
INSERT/ALL policy, WITH CHECK expression: Check new row [c]
UPDATE/ALL policy, USING expression: —
UPDATE/ALL policy, WITH CHECK expression: —
DELETE/ALL policy, USING expression: —

ON CONFLICT DO UPDATE

SELECT/ALL policy, USING expression: Check existing & new rows [d]
INSERT/ALL policy, WITH CHECK expression: —
UPDATE/ALL policy, USING expression: Check existing row
UPDATE/ALL policy, WITH CHECK expression: Check new row [d]
DELETE/ALL policy, USING expression: —

🌸 The footnotes, iconically: [a] If read access is required to either the existing or new row (for example, a WHERE or RETURNING clause that refers to columns from the relation). [b] If an arbiter index or constraint is specified. [c] Row proposed for insertion is checked regardless of whether or not a conflict occurs. [d] New row of the auxiliary UPDATE command, which might be different from the new row of the original INSERT command.

Application of Multiple Policies

Okay so when multiple policies of different command types apply to the same command — like SELECT and UPDATE policies both landing on an UPDATE command — the user has to have both types of permissions. Both. (For example: permission to select rows from the relation and permission to update them.) So the expressions for one type of policy get combined with the expressions for the other type using the AND operator. Package deal, no splitting. 🫶

When multiple policies of the same command type apply to the same command, then there must be at least one PERMISSIVE policy granting access to the relation, and all of the RESTRICTIVE policies must pass. So: all the PERMISSIVE policy expressions get combined using OR, all the RESTRICTIVE policy expressions get combined using AND, and then those results get combined using AND. And if there are no PERMISSIVE policies at all? Access is denied. Straight up. 🚫

Heads up: for the purposes of combining multiple policies, ALL policies are treated as having the same type as whichever other type of policy is being applied. Shape-shifter energy. ✨

For example, in an UPDATE command requiring both SELECT and UPDATE permissions, if there are multiple applicable policies of each type, they'll be combined like this:

expression from RESTRICTIVE SELECT/ALL policy 1
AND
expression from RESTRICTIVE SELECT/ALL policy 2
AND
...
AND
(
  expression from PERMISSIVE SELECT/ALL policy 1
  OR
  expression from PERMISSIVE SELECT/ALL policy 2
  OR
  ...
)
AND
expression from RESTRICTIVE UPDATE/ALL policy 1
AND
expression from RESTRICTIVE UPDATE/ALL policy 2
AND
...
AND
(
  expression from PERMISSIVE UPDATE/ALL policy 1
  OR
  expression from PERMISSIVE UPDATE/ALL policy 2
  OR
  ...
)

Lowkey beautiful once you see the shape of it — restrictive walls first, then a big friendly OR-pile of permissive options, all held together with ANDs. 🎀

🌸 NOTES 🌸

Okay bestie, gather round, because this part is lowkey the most tea-spilling section of the whole page 🫖✨

You must be the owner of a table to create or change policies for it. No owner energy, no policy power 💅

So here's the vibe check on how policies actually behave, and ngl it's a little spicy 🌶️

While policies are applied for explicit queries against tables in the database, they are not applied when the system is doing its internal referential integrity checks or validating constraints. Translation: there are indirect ways to figure out that a given value exists 👀. The docs give the receipts:

If you try to insert a duplicate value into a column that's a primary key or has a unique constraint, and the insert fails? Boom — the user can now infer that the value already exists. 😭 (This example assumes the user is permitted by policy to insert records that they're not allowed to see, iykyk.)
Another one: a user is allowed to insert into a table that references another, otherwise hidden table. They can determine existence by inserting values into the referencing table — if it succeeds, that indicates the value exists in the referenced table. Sneaky, sneaky 🕵️‍♀️

How to fix it: carefully craft your policies so users literally can't insert, delete, or update records at all in ways that might hint at a value they can't otherwise see 🚫 — or use generated values (e.g., surrogate keys) instead of keys with external meanings. Slay 💅

Generally, the system enforces filter conditions imposed using security policies prior to qualifications that appear in user queries, so protected data doesn't get accidentally exposed to user-defined functions that might not be trustworthy 🛡️. However — and this is the important bit — functions and operators marked by the system (or the system administrator) as LEAKPROOF may be evaluated before policy expressions, because they're assumed to be trustworthy. Trust the process, bestie 🫶

Another thing you need to know: since policy expressions are added to the user's query directly, they run with the rights of the user running the overall query. So everybody using a given policy must be able to access any tables or functions referenced in the expression — otherwise they'll just get a permission denied error when they try to query the table that has row-level security enabled 💀. That's the whole vibe.

But this doesn't change how views work, okay? As with normal queries and views, permission checks and policies for the tables referenced by a view will use the view owner's rights and any policies that apply to the view owner. Main character energy: the view owner 👑🌈

And if you want the full deep dive plus practical examples, go check out Section 5.8. It's giving required reading 📚✨

⭐ COMPATIBILITY ⭐

CREATE POLICY is a PostgreSQL extension. That's it, that's the whole section. Periodt 💅🎀

🦋 SEE ALSO 🦋

ALTER POLICY (ALTER_POLICY(7))
DROP POLICY (DROP_POLICY(7))
ALTER TABLE (ALTER_TABLE(7))

Go read those next, bestie, they're iconic too 💖🔥

Okay that's the whole page, mwah 💋 This masterpiece is from PostgreSQL 14.24, dated 2026, and it's the CREATE POLICY(7) manual page. Now go forth and secure those rows, queen 👑✨🌸

📦 where this page comes from

opensuse-leap 16.0: postgresql14 14.24-160000.1.1 · PostgreSQL
opensuse-leap 16.0: postgresql14 14.24-160000.1.1 · PostgreSQL
opensuse-leap 16.0: postgresql14 14.24-160000.1.1 · PostgreSQL
opensuse-leap 16.0: postgresql14 14.24-160000.1.1 · PostgreSQL
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms