Parameter · Client Connection Defaults / Statement Behavior
row_security
Enables row security. When enabled, row security will be applied to all users.
- Default:
on - Type: bool
- Applies: Session (any user)
In plain words
Row-level security (RLS) policies silently filter which rows a user can see. With this setting on (default), the filtering happens. If you turn it off, any query that would be filtered raises an error instead, so you never get a silently incomplete result.
For DBAs and operators
It does not turn RLS off for normal users; that would be a security hole. With row_security = off, a query on a table where at least one policy would apply fails:
ERROR: query would be affected by row-level security policy for table "accounts"
Superusers, table owners (unless FORCE ROW LEVEL SECURITY) and roles with BYPASSRLS are not affected because policies do not apply to them anyway.
The main user is pg_dump: it sets row_security = off so a dump either contains all rows or fails loudly, instead of quietly dumping only the rows the dumping role can see. Use pg_dump --enable-row-security when you intentionally want a filtered dump. If a dump fails with the error above, run it as a role with BYPASSRLS or as the owner.
How to change it
Any user can change it for their session with SET.