Write owner-based RLS policies

Enable Row Level Security on every exposed application table. A policy should express who may perform one operation and which rows qualify.

Use auth.uid() against an indexed owner column. Read policies use USING; inserted or changed rows need WITH CHECK so a user cannot assign ownership to someone else.

Create policies for private notes. Prove user A can manage one note and user B cannot read, modify, or delete it.

Enable RLS and express ownership for one operation at a time:

alter table notes enable row level security;

create policy "read own notes"
on notes for select
using (user_id = auth.uid());

Add separate insert, update, and delete policies with the correct USING and WITH CHECK expressions. Test no session, the owner, and another authenticated user. Never use the service-role key for these tests because it bypasses the boundary you are trying to prove.