Audit existing RLS policy gaps across all tables

Use this SQL query to enumerate all existing RLS policies: SELECT schemaname, tablename, policyname, permissive, roles, cmd, qual, with_check FROM pg_policies WHERE schemaname = 'public' ORDER BY tablename, cmd; — run this in the Supabase SQL editor. Cross-reference results against the full table list. For tables not appearing in pg_policies results, check RLS enabled status via: SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'; — rowsecurity = false means RLS is disabled (critical gap). When reviewing existing policies, look for the pattern: USING (auth.uid() = user_id) which is user-scoped but not org-scoped — this is a gap for admin roles.

Document the JWT claim structure by checking Supabase Auth → JWT template in the Dashboard — the org_id and role claims must be present in the custom claims section. If they are not present, flag this as a blocker for task-003 and task-004 since RLS policies will depend on these claims.

This is an audit task — the primary output is a gap report document, not code. Verification: (1) Cross-check pg_policies catalog query results against the Supabase Dashboard policy editor UI to confirm no policies are missing from the query; (2) Run at least one manual test per table: use a test org_admin JWT and attempt SELECT/INSERT/UPDATE/DELETE via the Supabase client — confirm that operations return data scoped to the test org only (or are blocked for disallowed operations); (3) For any table with no RLS enabled, verify that direct table access without a WHERE clause returns all rows — this confirms the critical gap. Document test evidence (screenshots or query results) in the gap report appendix.