Dynamic RLS

[solemn lance]

Can RLS be dynamic, like the actions will be defined in UI and stored in db, and then mapped realtime?

[inner saffron]

Hi @solemn lance. I'm kapa.ai, your friendly support bot. I will try to answer your question by searching through the knowledge base. :wave:

---

Convex’s Row Level Security (RLS) system is implemented in TypeScript code, allowing you to define access rules dynamically based on context, user identity, and even data fetched at runtime. The RLS helpers (like those in convex-helpers) let you write rules that can depend on any logic you want—including data stored in your database. This means you can, in principle, store RLS policies or actions in your database and have your RLS rule functions read and interpret them at runtime, making the system dynamic and adaptable to changes made via your UI.

For example, the RLS rules are defined as async functions that receive the context and can perform arbitrary logic, including database reads. This allows you to fetch policy definitions or permissions from your tables and use them to determine access in real time:

async function rlsRules(ctx: QueryCtx) {
  // Fetch dynamic rules or permissions from the database
  const dynamicRules = await ctx.db.query("rls_policies").collect();
  return {
    messages: {
      read: async (ctx, message) => {
        // Apply dynamic logic based on fetched rules
        // ...
      },
      modify: async (ctx, message) => {
        // Apply dynamic logic based on fetched rules
        // ...
      },
    },
  };
}

This pattern is supported and discussed in Convex documentation and community threads, where it’s noted that RLS rules can be as dynamic as your application requires, since they are just code and can use any data available at runtime. You can even customize the context passed to your rules to include pre-fetched data for efficiency, as shown in the Extending access functions section.

However, you should be mindful of performance and complexity: fetching and interpreting dynamic rules for every access can introduce overhead and make your authorization logic harder to reason about. The documentation suggests keeping rules as simple as possible and pushing more complex logic up a layer if needed, but technically, dynamic RLS as you describe is fully supported by Convex’s architecture and helper patterns Authorization via row-level security Extending access functions.

In summary:
Yes, Convex RLS can be dynamic, with rules/actions defined in the UI, stored in the database, and mapped in real time by your RLS rule functions.

Note: you can ask me a follow up question by @ mentioning me again :speech_balloon: