Role changes in an identity provider and authorization claims in a JWT do not move at the same time.
Enterprise administrators need prompt access changes, while PostgreSQL RLS must continue to trust only the claims it receives.
Who you’d be doing this for
“Our admin changed the role before the demo, and I had to explain why the user still got a 401.”
Ha Le · Platform Engineer
Owns enterprise SSO onboarding for a B2B SaaS application using JWT claims to drive PostgreSQL RLS.
What is at stake
Customers are granting temporary access when SAML roles do not appear in JWT claims as expected. You must weigh faster role-change guidance against preserving the authorization boundaries that RLS depends on.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- faster enterprise onboarding vs. trusted authorization claims
- reusable guidance vs. identity-provider variation
- lower repeat volume vs. complete reproduction evidence
- manual access exceptions vs. RLS integrity
Why Supabase
Supabase Auth joins SAML SSO, JWTs, and PostgreSQL RLS in the same application access path.
Written with these in mind
Not your kind of problem? 19 more at Supabase, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.