What is row-level security (rls)?
Row-level security attaches a policy to a table so the database itself evaluates, for every row, whether the requesting identity may see it. Default-deny means no row is visible unless a policy explicitly allows it, so a missing policy is a locked table rather than an open one.
Why it matters
It moves the isolation guarantee below the application, where a code path cannot forget it. That is why isolation claims are worth checking at this layer: an API that says "we filter by tenant" is making a promise about its own correctness, not a structural one.