martineliasczQ: RLS Policies Inquiry
Hi Riya,
Does NoCodeBackend support:
- An authenticated private_read / own_read_only policy?
Similar to the public RLS:
- public_read
- public_write
- public_readwrite
- public_scoped_read
- public_scoped_write
- public_scoped_readwrite
Is it possible to restrict private/authenticated users to read_only?
Thank you so much for your help on this!
Riya_NoCodeBackend
May 28, 2026A: Hi,
Currently we have below:
Row Level Security (RLS): Controls who can access each table's data.
Private (default) — Only the logged-in admin who created the data can see it. Authentication required.
Shared — All logged-in admins can see each other's data (useful for team features). Authentication still required.
Public — Anyone on the internet can access the data without logging in, via /api/public-data/ (useful for booking pages, blogs, storefronts).
Scoped Public — Same as Public, but data is filtered to a specific admin using owner_id (e.g. show only Admin A's event types on their booking page).
You can combine one Shared + one Public policy per table. The admin panel (/api/data/) always requires login regardless of the policy set here.
Verified purchaser
Hi Riya, thank you for your reply! To make this super clear: It is currently not possible for authenticated users to access authenticated table with read only permission (immutable table) and with write permission on another table, right?
Hi,
Yes correct.