rls

Fixing Postgres RLS Recursion with a JWT Custom Claims Hook

A single GRANT line triggered an infinite RLS recursion (42P17) in Postgres. How moving role checks out of user_roles into a signed JWT claim fixed it—and its trade-offs.