PostgreSQL row-level security (which PostgREST defers to) is very flexible, more or less anything expressible as a SQL query can be used to filter what the user

PostgreSQL row-level security (which PostgREST defers to) is very flexible, more or less anything expressible as a SQL query can be used to filter what the user can see. You can see an example here: https://postgrest.org/en/stable/auth.html#roles-for-each-web-user https://postgrest.org/en/stable/auth.html#roles-for-each-web... The main downside of RLS is that complex queries may require hand-optimizing.