Implement Row-Level Security Filtering

Problem Given a set of row-level-security-style policies (predicates attached to roles) and a query issued by a user, return only the rows that user is permitted to see. Multiple policies may apply to a user and must combine correctly.

Input / Output

• Input: a set of rows, a set of policies (each a role + predicate), and the requesting user (with roles).
• Output: the subset of rows the user may see.

Requirements

• Evaluate each applicable policy's predicate against a row.
• Combine multiple policies with the right boolean semantics (permissive policies OR together; restrictive ones AND).

Example

• Policy "user sees own rows" → keep rows where row.owner == user.id; a second permissive policy widens the visible set via OR.