Date: Fri, 1 Nov 2024 10:23:25 -0400
From: Bruce Momjian <bruce@momjian.us>
To: splarv@ya.ru, pgsql-docs@lists.postgresql.org
Subject: Re: fir for row level security
Message-ID: <ZyTkXdes2-Gyfyww@momjian.us>
References: <173045909386.700.9231055113418242392@wrigleys.postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="Y5oCNyhPHQnUGpal"
Content-Disposition: inline
In-Reply-To: <173045909386.700.9231055113418242392@wrigleys.postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/ZyTkXdes2-Gyfyww%40momjian.us>
Precedence: bulk


--Y5oCNyhPHQnUGpal
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Nov  1, 2024 at 11:04:53AM +0000, PG Doc comments form wrote:
> The following documentation comment has been logged on the website:
> 
> Page: https://www.postgresql.org/docs/16/ddl-rowsecurity.html
> Description:
> 
> Cite
> When multiple policies apply to a given query, they are combined using
> either OR (for permissive policies, which are the default) or using AND (for
> restrictive policies). This is similar to the rule that a given role has the
> privileges of all roles that they are a member of.
> end cite
> 
> Not clear for what is "this is". May be better "The default behaviour is
> similar..."

I see your point.  Attached is a patch which clarifies this.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  When a patient asks the doctor, "Am I going to die?", he means 
  "Am I going to die soon?"

--Y5oCNyhPHQnUGpal
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="policy.diff"

diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml
index f6344b3b79a..b4554253fbe 100644
--- a/doc/src/sgml/ddl.sgml
+++ b/doc/src/sgml/ddl.sgml
@@ -2592,7 +2592,8 @@ GRANT SELECT (col1), UPDATE (col1) ON mytable TO miriam_rw;
    When multiple policies apply to a given query, they are combined using
    either <literal>OR</literal> (for permissive policies, which are the
    default) or using <literal>AND</literal> (for restrictive policies).
-   This is similar to the rule that a given role has the privileges
+   The <literal>OR</literal> behavior is similar to the rule that a given
+   role has the privileges
    of all roles that they are a member of.  Permissive vs. restrictive
    policies are discussed further below.
   </para>

--Y5oCNyhPHQnUGpal--