RLS says yes and Postgres still says permission denied: the 403 family I only understood on the second one

Automated excerpt

In the frontend the admin is the authenticated role. So the chain was: admin → authenticated → INVOKER RPC → the RPC writes users. balance still as authenticated → no column grant → permission denied. is_admin() cleared the admin at the row level. There must be other INVOKER functions writing privileged users columns as authenticated, sitting there untriggered because nobody has walked that path yet.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.