From 5eff502fa1204ede1c8d804a97f4e38cd86d1a3f Mon Sep 17 00:00:00 2001
From: Dmitry Maranik <40249835+dmitrymaranik@users.noreply.github.com>
Date: Tue, 14 Jul 2026 23:35:51 -0700
Subject: [PATCH] perf(rls): wrap current_setting() in org-isolation policies
 so it evaluates once per statement (InitPlan)

---
 RLS_SETUP.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/RLS_SETUP.md b/RLS_SETUP.md
index 5d4be8e9..55060889 100644
--- a/RLS_SETUP.md
+++ b/RLS_SETUP.md
@@ -229,14 +229,14 @@ Each table has two policies:
    ```sql
    CREATE POLICY org_isolation ON "lead"
        FOR ALL
-       USING (org_id::text = NULLIF(current_setting('app.current_org', true), ''));
+       USING (org_id::text = (select NULLIF(current_setting('app.current_org', true), '')));
    ```
 
 2. **Insert Check Policy**:
    ```sql
    CREATE POLICY org_insert_check ON "lead"
        FOR INSERT
-       WITH CHECK (org_id::text = NULLIF(current_setting('app.current_org', true), ''));
+       WITH CHECK (org_id::text = (select NULLIF(current_setting('app.current_org', true), '')));
    ```
 
 The `NULLIF(..., '')` ensures **no rows are returned** when context is not set (fail-safe).