Relying on the PG user/role system doesn't feel general enough to me. A better solution would set a query on the connection that constrains which rows it can t

Relying on the PG user/role system doesn't feel general enough to me. A better solution would set a query on the connection that constrains which rows it can touch. I know this ends up being more complicated and less performant but it splits the difference between app-level and database-enforced security.