# Preset Embedded Rls

> Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.

- Skill: `preset-io/preset-embedded-rls` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add preset-io/preset-embedded-rls`
- Raw SKILL.md: https://api.skillmd.com/api/skills/preset-io/preset-embedded-rls/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: preset-io (https://skillmd.com/u/preset-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/preset-io/preset-embedded-rls

---


# preset-embedded-rls

Use before guest-token creation when embedded viewers need row-level security.

## Always

- Auth and conventions come from `preset-api` (JWT exchange, base URLs, Rison); resolve the workspace hostname through the Management API when it is not already known. Consult metadata skills only when column validation is required.
- Do not invent tenant identifiers, filters, dataset columns, or access rules.
- Treat RLS clauses as permission controls that can leak or hide customer data.
- Confirm every clause and intended viewer population before token creation.
- Do not validate with broad data-returning queries unless the user approves target and limit.

## Decision Rules

- Classify embedded RLS review as plan-only safety work.
- Identify tenant and user filter safety issues.
- Require approval before clauses are used in token claims.
- Avoid mutating embedded RLS configuration.

## Workflow Order

1. Inspect embedded RLS clauses.
2. Flag unsafe tenant and user filters.
3. Summarize approval requirements.
4. Stop before using clauses in tokens.

## Retrieve

- Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)