How do I fix RLS errors?

First, read the actual error

RLS errors surface as 401/403 responses, or messages like "new row violates row-level security policy". Note three things before you touch anything:

• Which table.
• Which operation (SELECT, INSERT, UPDATE, DELETE).
• Which role was making the request (anonymous or a specific logged-in user).

Fixing it step by step

1. Ask Lovable to show you the current RLS policies on the affected table.
2. Compare them against what should actually be allowed. Missing an INSERT policy is the most common gap — a table often gets a SELECT policy automatically but nothing for writes.
3. Ask Lovable to add or correct the specific policy:

Add an INSERT policy on the comments table so authenticated users can insert rows where user_id equals their own auth.uid()

4. Re-test the exact action that failed, not just "does the app load".
5. If the table needs different rules per role (e.g. admins can update anything, regular users only their own rows), make sure roles come from a separate user_roles table, not a column on the user's profile.

What usually goes wrong

• Disabling RLS to stop the error. This "fixes" the symptom by removing all protection — never do this on a table with real user data.
• Writing using (true) as a shortcut, which is equivalent to no policy at all for that operation.
• Policy checks the wrong column — e.g. checking id instead of user_id, so it never matches.
• Forgetting policies are per-operation — fixing SELECT doesn't fix INSERT.
• Testing as the wrong user — an admin-only policy will correctly 403 a normal test account; that's not a bug.

Prompt to diagnose faster

I'm getting a 403 inserting into bookings. Show me the table's RLS policies, tell me which one should cover this insert, and fix it if none does.

See also /questions/why-is-supabase-returning-a-403-error and /questions/what-is-row-level-security-rls.