Umbral RLS

The safest tenant isolation is the kind your application code can't accidentally forget. Umbral RLS pushes it down into Postgres itself: FORCE row-level security with a per-request GUC set through the connection pool, so one request's tenant context can never leak into another's — even a buggy handler that omits a WHERE tenant_id = ... is caught by the database. It's the last line of defence, below your code, where a forgotten filter turns into zero rows instead of someone else's data.

Install

cargo add umbral-rls

Postgres only — RLS is a Postgres feature. On SQLite the plugin skips with a warning rather than silently diverging.

Wire it up

Declare a policy per protected table; the plugin sets the per-request context on the pool.

use umbral::prelude::*;
use umbral_rls::RlsPlugin;

let app = App::builder()
    .database("default", pool)
    .plugin(
        RlsPlugin::new()
            .policy("invoice", "tenant_id = current_setting('app.tenant')::bigint"),
    )
    .build()?;

Target: defence in depth for a multi-tenant SaaS

Pair it with umbral-tenants: tenants routes and scopes the request; RLS makes the database enforce the boundary even if the routing layer has a bug.

What you get

• FORCE row-level security so table owners aren't exempt
• Per-request GUC set through the pool — no cross-request leak
• Policies declared in Rust, applied as migrations
• The database enforces isolation even when a handler forgets
• Pairs with umbral-tenants for layered multi-tenancy