Use as the RLS build stage of the Butterbase journey, after journey-schema. Implements the RLS section of 02-plan.md by delegating to debug-rls policy patterns (for proactive creation, not debugging). Calls manage_rls (create_user_isolation, enable, create_policy). Folded into journey-schema when hackathon_mode is true.
Installs into .claude/skills of the current project.
Are you the author of Journey Rls?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/butterbase-ai-journey-rls)
---
name: journey-rls
description: Use as the RLS build stage of the Butterbase journey, after journey-schema. Implements the RLS section of 02-plan.md by delegating to debug-rls policy patterns (for proactive creation, not debugging). Calls manage_rls (create_user_isolation, enable, create_policy). Folded into journey-schema when hackathon_mode is true.
---
# Journey: RLS
Stage 3b of the guided journey. Install Row-Level Security policies for user-owned tables.
## When to use
- Dispatched by `journey` when `current_stage: rls`.
- Directly via `/butterbase-skills:journey-rls`.
- Folded into `journey-schema` when `hackathon_mode: true` (do not run separately).
## Preflight
If `docs/butterbase/03-preflight.md` is missing, older than 24 hours, or `00-state.md` has `app_id: null`, invoke `butterbase-skills:journey-preflight` first. Wait for it to return successfully before proceeding.
## Inputs
- `docs/butterbase/02-plan.md` — the RLS section.
- `docs/butterbase/00-state.md` — for `app_id`.
## Procedure
0. **Refresh docs.** Call `butterbase_docs` with `topic: "auth"`. For RLS-specific patterns, also WebFetch `https://docs.butterbase.ai/auth/rls`. Skip if cache is fresh.
1. Read the RLS section of `02-plan.md`. Print it back: `"About to install RLS policies: <list>. Proceed?"`. Wait for `yes`.
2. Invoke `butterbase-skills:debug-rls` via the Skill tool with mode `proactive`, passing the RLS plan and `app_id`. For each user-isolation entry, the wrapped skill calls `manage_rls action: create_user_isolation`. For custom policies, `manage_rls action: enable` then `action: create_policy`.
3. After it returns, sanity-check with `manage_rls action: list` and show the user.
4. Append one line to `docs/butterbase/04-build-log.md`:
`<ISO timestamp> rls manage_rls ok`
5. Tick `- [x] rls` in `00-state.md`, set `current_stage:` to the next unchecked stage, bump `last_updated`.
6. Return to `journey` orchestrator (or ask `"Continue to the next stage? (yes/no)"`).
## Outputs
- Live RLS policies in the Butterbase app.
- One line in `04-build-log.md`.
## Anti-patterns
- ❌ Skipping `manage_rls action: list` verification — invisible policy failures are the #1 RLS gotcha.
- ❌ Creating policies on a table where RLS is not enabled — `enable` must come first.
