RLS recursion infinite loop: why I gave up policies and bet everything on a JWT custom claims hook

Short summary

A Supabase developer hit infinite RLS recursion when adding an agent_readonly role to the authenticated membership, because permissive policies evaluating user_roles created a loop through Postgres role inheritance. After trying SECURITY DEFINER wrappers and role isolation, the author moved role data into signed JWT custom claims via Supabase's Custom Access Token Hook, so policies read auth.jwt() instead of querying the permissions table. This mechanically eliminates recursion because the permissions table is no longer queried during permission evaluation.

• •RLS recursion can arise structurally from Postgres role membership inheritance, not just self-referencing policies
• •SECURITY DEFINER patches work short-term but create opaque, hard-to-audit permission surfaces over time
• •Moving roles into JWT custom claims via Supabase Auth hooks eliminates the recursion by removing database queries from permission evaluation

Generated with AI, which can make mistakes.