1 piece
A row-level security policy that lets a user update their own row is correct for a display name and catastrophic for a plan tier or a role. The policy decides which rows a write may touch. The damage comes from which columns. Self-escalation is a class of defect rather than a bug, and the controls that address it are column-level grants, a schema split between user-editable and system-owned fields, and an audit that fails when a new column appears.