---
name: Journey RLS
slug: journey-rls
category: DevOps
description: Journey RLS installs row-level security policies for Butterbase user-owned tables during the guided build flow. Use it after schema planning or when the journey reaches the RLS stage, and it can fold into the schema stage in hackathon mode.
github: "https://github.com/butterbase-ai/butterbase-skills/tree/main/skills/journey-rls"
stars: 532
forks: 40
install: "npx degit https://github.com/butterbase-ai/butterbase-skills/tree/main/skills/journey-rls ~/.claude/skills/journey-rls"
installs_to: ~/.claude/skills/journey-rls
source_path: skills/journey-rls/SKILL.md
collection_size: 25
category_size: 798
collection_url: "https://dirskills.com/collections/butterbase-ai/butterbase-skills"
added: 2026-08-26T05:11:43.023Z
last_synced: 2026-08-26T05:11:43.023Z
canonical_url: "https://dirskills.com/skills/journey-rls"
---

# Journey RLS

Journey RLS installs row-level security policies for Butterbase user-owned tables during the guided build flow. Use it after schema planning or when the journey reaches the RLS stage, and it can fold into the schema stage in hackathon mode.

**Install:**

```bash
npx degit https://github.com/butterbase-ai/butterbase-skills/tree/main/skills/journey-rls ~/.claude/skills/journey-rls
```

## README

# Journey: RLS

Stage 3b of the guided journey. Install Row-Level Security policies for user-owned tables.

## When to use

- Dispatched by `journey` when `current_stage: rls`.
- Directly via `/butterbase-skills:journey-rls`.
- Folded into `journey-schema` when `hackathon_mode: true` (do not run separately).

## Preflight

If `docs/butterbase/03-preflight.md` is missing, older than 24 hours, or `00-state.md` has `app_id: null`, invoke `butterbase-skills:journey-preflight` first. Wait for it to return successfully before proceeding.

## Inputs

- `docs/butterbase/02-plan.md` — the RLS section.
- `docs/butterbase/00-state.md` — for `app_id`.

## Procedure

0. **Refresh docs.** Call `butterbase_docs` with `topic: "auth"`. For RLS-specific patterns, also WebFetch `https://docs.butterbase.ai/auth/rls`. Skip if cache is fresh.

1. Read the RLS section of `02-plan.md`. Print it back: `"About to install RLS policies: <list>. Proceed?"`. Wait for `yes`.
2. Invoke `butterbase-skills:debug-rls` via the Skill tool with mode `proactive`, passing the RLS plan and `app_id`. For each user-isolation entry, the wrapped skill calls `manage_rls action: create_user_isolation`. For custom policies, `manage_rls action: enable` then `action: create_policy`.
3. After it returns, sanity-check with `manage_rls action: list` and show the user.
4. Append one line to `docs/butterbase/04-build-log.md`:
   `<ISO timestamp>  rls  manage_rls  ok`
5. Tick `- [x] rls` in `00-state.md`, set `current_stage:` to the next unchecked stage, bump `last_updated`.
6. Return to `journey` orchestrator (or ask `"Continue to the next stage? (yes/no)"`).

## Outputs

- Live RLS policies in the Butterbase app.
- One line in `04-build-log.md`.

## Anti-patterns

- ❌ Skipping `manage_rls action: list` verification — invisible policy failures are the #1 RLS gotcha.
- ❌ Creating policies on a table where RLS is not enabled — `enable` must come first.