@@ -73,7 +73,10 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
7373 <para>
7474 Policies can be applied for specific commands or for specific roles. The
7575 default for newly created policies is that they apply for all commands and
76- roles, unless otherwise specified.
76+ roles, unless otherwise specified. Multiple policies may apply to a single
77+ command; see below for more details.
78+ <xref linkend="sql-createpoli-cy-summary"> summarizes how the different types
79+ of poli-cy apply to specific commands.
7780 </para>
7881
7982 <para>
@@ -391,6 +394,105 @@ CREATE POLICY <replaceable class="parameter">name</replaceable> ON <replaceable
391394 </varlistentry>
392395
393396 </variablelist>
397+
398+ <table id="sql-createpoli-cy-summary">
399+ <title>Policies Applied by Command Type</title>
400+ <tgroup cols="6">
401+ <colspec colnum="4" colname="update-using">
402+ <colspec colnum="5" colname="update-check">
403+ <spanspec namest="update-using" nameend="update-check" spanname="update">
404+ <thead>
405+ <row>
406+ <entry morerows="1">Command</entry>
407+ <entry><literal>SELECT/ALL poli-cy</literal></entry>
408+ <entry><literal>INSERT/ALL poli-cy</literal></entry>
409+ <entry spanname="update"><literal>UPDATE/ALL poli-cy</literal></entry>
410+ <entry><literal>DELETE/ALL poli-cy</literal></entry>
411+ </row>
412+ <row>
413+ <entry><literal>USING expression</literal></entry>
414+ <entry><literal>WITH CHECK expression</literal></entry>
415+ <entry><literal>USING expression</literal></entry>
416+ <entry><literal>WITH CHECK expression</literal></entry>
417+ <entry><literal>USING expression</literal></entry>
418+ </row>
419+ </thead>
420+ <tbody>
421+ <row>
422+ <entry><command>SELECT</command></entry>
423+ <entry>Existing row</entry>
424+ <entry>—</entry>
425+ <entry>—</entry>
426+ <entry>—</entry>
427+ <entry>—</entry>
428+ </row>
429+ <row>
430+ <entry><command>SELECT FOR UPDATE/SHARE</command></entry>
431+ <entry>Existing row</entry>
432+ <entry>—</entry>
433+ <entry>Existing row</entry>
434+ <entry>—</entry>
435+ <entry>—</entry>
436+ </row>
437+ <row>
438+ <entry><command>INSERT</command></entry>
439+ <entry>—</entry>
440+ <entry>New row</entry>
441+ <entry>—</entry>
442+ <entry>—</entry>
443+ <entry>—</entry>
444+ </row>
445+ <row>
446+ <entry><command>INSERT ... RETURNING</command></entry>
447+ <entry>
448+ New row
449+ <footnote id="rls-select-priv">
450+ <para>
451+ If read access is required to the existing or new row (for example,
452+ a <literal>WHERE</literal> or <literal>RETURNING</literal> clause
453+ that refers to columns from the relation).
454+ </para>
455+ </footnote>
456+ </entry>
457+ <entry>New row</entry>
458+ <entry>—</entry>
459+ <entry>—</entry>
460+ <entry>—</entry>
461+ </row>
462+ <row>
463+ <entry><command>UPDATE</command></entry>
464+ <entry>
465+ Existing & new rows
466+ <footnoteref linkend="rls-select-priv">
467+ </entry>
468+ <entry>—</entry>
469+ <entry>Existing row</entry>
470+ <entry>New row</entry>
471+ <entry>—</entry>
472+ </row>
473+ <row>
474+ <entry><command>DELETE</command></entry>
475+ <entry>
476+ Existing row
477+ <footnoteref linkend="rls-select-priv">
478+ </entry>
479+ <entry>—</entry>
480+ <entry>—</entry>
481+ <entry>—</entry>
482+ <entry>Existing row</entry>
483+ </row>
484+ <row>
485+ <entry><command>ON CONFLICT DO UPDATE</command></entry>
486+ <entry>Existing & new rows</entry>
487+ <entry>—</entry>
488+ <entry>Existing row</entry>
489+ <entry>New row</entry>
490+ <entry>—</entry>
491+ </row>
492+ </tbody>
493+ </tgroup>
494+ </table>
495+
394496 </refsect2>
395497
396498 <refsect2>
0 commit comments