Database-Level Zero-Trust Access Isolation

Access Control Isolation

The platform partitions operations across sys-admin, coach, parent, and player roles directly within the database layer using PostgreSQL Row-Level Security (RLS) policies. This ensures queries execute within safe transactional boundaries and prevents client-side state manipulation from compromising user profiles or operational records.

Security Policies

For the core coach_drills table, edit and deletion permissions are restricted to the owner of the resource or administrative roles:

CREATE POLICY "Coaches and Admins can manage drills"
ON public.coach_drills
FOR ALL
USING (
    auth.uid() = coach_id
    OR EXISTS (
        SELECT 1 FROM public.profiles
        WHERE profiles.id = auth.uid()
        AND profiles.role IN ('admin', 'sys-admin')
    )
)
WITH CHECK (
    auth.uid() = coach_id
    OR EXISTS (
        SELECT 1 FROM public.profiles
        WHERE profiles.id = auth.uid()
        AND profiles.role IN ('admin', 'sys-admin')
    )
);