The original title is: "Does Prisma respect Supabase RLS? No — here's why"

Short summary

Prisma and Drizzle bypass Supabase Row Level Security because they connect as the postgres role, which owns tables and carries BYPASSRLS. The fix is to point ORM connections at a dedicated, non-owner NOBYPASSRLS role instead of postgres. This is a per-role, per-statement enforcement issue—not a bug in your policies.

• •Prisma/Drizzle connect as postgres role which bypasses RLS by default
• •supabase-js enforces RLS via PostgREST with unprivileged anon/authenticated roles
• •Fix: use a dedicated NOBYPASSRLS role for ORM connections

Generated with AI, which can make mistakes.