Joseph RwandaHire me

2026-07-31 · supabase data

Supabase Row-Level Security for Multi-Site WMS

Encode site, role, and partner in JWT claims, write Postgres RLS policies that match those claims, and test policies in CI before dashboards or copilots touch production. Isolation is a product feature — not a dashboard filter.

Isolation is the product

Multi-site logistics must isolate inventory per facility while still allowing regional AI copilots to run sanctioned analytics. A WHERE site_id = filter in the UI is not security.

Approach

  • JWT claims carry site, role, and partner.
  • RLS policies enforce those claims on scan, stock, and ticket tables.
  • CI runs policy tests before Vercel deploys of ops dashboards.
  • Copilots inherit the same identity — they cannot read what the operator cannot.

This pairs with streaming barcode ingest and shows up in how multi-tenant products like Soko ERP separate businesses and locations.

Key takeaways

  • Design claims before tables.
  • Test negative cases (cross-site reads) as hard as happy paths.
  • AI tools must use the same RLS boundary as humans.

Further reading

FAQ

Can regional AI copilots still see global analytics?

Yes — with explicit roles and policies for aggregate views, not by disabling RLS. Keep site-scoped writes strict; open read paths only where the claim set justifies it.

Related work

  • Soko ERP — The ERP built for East Africa — POS, inventory, HR, accounts, and reports in one platform.
  • WaybillAgent — Walk the warehouse, Claude does the audit.

Canonical on https://josephrwanda.com/writing/supabase-rls-for-wms. Cross-posts should link back here.