docs: Reword CREATE POLICY documentation.
This commit is contained in:
parent
1e78d81e88
commit
39f2594ba5
|
@ -39,16 +39,18 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<para>
|
<para>
|
||||||
A policy is an expression which is added to the security-barrier
|
A policy limits the ability to SELECT, INSERT, UPDATE, or DELETE rows
|
||||||
qualifications of queries which are run against the table the policy is on,
|
in a table to those rows which match the relevant policy expression.
|
||||||
or an expression which is added to the with-check options for a table and
|
Existing table rows are checked against the expression specified via
|
||||||
which is applied to rows which would be added to the table.
|
USING, while new rows that would be created via INSERT or UPDATE are
|
||||||
The security-barrier qualifications will always be evaluated prior to any
|
checked against the expression specified via WITH CHECK. Generally,
|
||||||
user-defined functions or user-provided WHERE clauses, while the with-check
|
the system will enforce filter conditions imposed using security
|
||||||
expression will be evaluated against the rows which are going to be added to
|
policies prior to qualifications that appear in the query itself, in
|
||||||
the table. By adding policies to a table, a user can limit the rows which a
|
order to the prevent the inadvertent exposure of the protected data to
|
||||||
given user can select, insert, update, or delete. This capability is also
|
user-defined functions which might not be trustworthy. However,
|
||||||
known as Row Level Security or RLS.
|
functions and operators marked by the system (or the system
|
||||||
|
administrator) as LEAKPROOF may be evaluated before policy
|
||||||
|
expressions, as they are assumed to be trustworthy.
|
||||||
</para>
|
</para>
|
||||||
|
|
||||||
<para>
|
<para>
|
||||||
|
|
Loading…
Reference in New Issue