sqlite-rlsRow-level security for SQLite

Declarative policies, per-query user context, and real enforcement — in one small loadable extension that works from any driver.

What is this?

Getting started

Language guides

Policies, not plumbing

Describe who can see and change each row in a small JSON policy — Postgres-style USING and WITH CHECK. Your existing SQL keeps working unchanged.

Per-query identity

Bind the current user's claims right before a query — not per-connection, not per-transaction. The same connection can serve a different user on the very next statement.

Bring your own user store

Claims can come from a JWT, a session table, an HTTP call, anywhere. Point the extension at a resolver query, or just hand it the claims you already have.

Works with any driver

It's a standard loadable extension. Verified from better-sqlite3, node:sqlite, Bun, Python, C, and Rust — the exact same three moves in each.

Actually enforced

A built-in authorizer keeps application code off the base tables, blocks DDL and ATTACH, and fails closed when no user is bound. Not just a convention.

Small and self-contained

One C file, no dependencies beyond SQLite itself. Around 33 KB compiled. Read it in an afternoon.

The idea in thirty seconds

SQLite has no built-in row-level security. sqlite-rls adds it by turning each protected table into a filtered view plus triggers, driven by the current user's claims that you bind per query:

sql

-- once, at setup:
SELECT rls_protect('{
  "table":  "documents",
  "select": "owner_id = rls_ctx(''user_id'') OR rls_ctx(''role'') = ''admin''",
  "insert": "NEW.owner_id = rls_ctx(''user_id'')"
}');
SELECT rls_guard();                       -- drop privileges

-- per request:
SELECT rls_set_context('{"user_id": 42, "role": "user"}');
SELECT * FROM documents;                  -- only user 42's rows come back

No query rewriting, no ORM plugin, no separate policy engine. Just SQL your application was already writing, now scoped to the person making the request.

Head to What is sqlite-rls? for the gentle tour, or jump straight to your language guide.