Deprecated auth.role() and auth.email() functions in RLS policies
Last edited: October 13, 2026
The auth.role() function is now deprecated
The auth.role() function has been deprecated in favour of using the TO field, natively supported within Postgres:
-- DEPRECATEDcreate policy "Public profiles are viewable by everyone."on profiles for select using ( auth.role() = 'authenticated' or auth.role() = 'anon');-- RECOMMENDEDcreate policy "Public profiles are viewable by everyone."on profiles for selectto authenticated, anonusing ( true);The auth.email() function is now deprecated
The auth.email() function has been deprecated in favour a more generic function to return the full JWT:
- DEPRECATEDcreate policy "User can view their profile."on profiles for select using ( auth.email() = email);-- RECOMMENDEDcreate policy "User can view their profile."on profiles for select using ( (auth.jwt() ->> 'email') = email);Related topics
- Row Level Security
- Row Level Security performance
- JSON Web Tokens (JWTs)
- RLS simplified
- RLS performance and best practices