feat: promote build-rls-003-org-roles-permissions to benchmark suite - #162
Open
mattrossman wants to merge 11 commits into
Open
feat: promote build-rls-003-org-roles-permissions to benchmark suite#162mattrossman wants to merge 11 commits into
mattrossman wants to merge 11 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
mattrossman
added
the
run-evals-changed
Drops soft-delete and audit-log requirements. They weren't part of the actual motivation for promoting this scenario (org/role RLS complexity), and every scorer bug we hit lived in that bolted-on logic.
…d-rls-003-org-roles-permissions' into mattrossman/ai-1006-promote-build-rls-003-org-roles-permissions
Matches the checkX(ctx) pattern used elsewhere in the repo instead of imperative checks.push() calls. Also normalizes ctx.query into a non-throwing runAsUser helper so an RLS-blocked write (a real Postgres error) is a value each check judges, not an exception that silently aborts every check after it.
Seeds a user who's a viewer in org A and admin in org B, then checks that their org-B admin role doesn't leak into org A. Every seeded user previously belonged to exactly one org, so a policy that checked role without joining on org_id would have passed undetected. All tested benchmark agents still pass, but it's real coverage for a common multi-tenant RLS mistake.
Fixed a stale "active documents" reference left over from the removed soft-delete concept, and swapped an unverified PostgREST claim for a cited Supabase testing-guide reference.
mattrossman
removed
the
run-evals-changed
Removes check comments that just restated their function name, merges asUser into runAsUser since the split had no independent caller, and clarifies the multi-org role-leak comment to name the memberships table explicitly.
mattrossman
marked this pull request as ready for review
August 4, 2026 15:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
build-rls-003-org-roles-permissionsto the benchmark suite and tweaks its prompt / scoring.Originally this scenario also tested the soft-delete and audit log implementation pattern, for which I found motivations FDBKIN-8277 and FDBKIN-9175 respectively, however I removed these from the scenario to keep the focus on RLS.
Other changes:
motivationmemberroster visibility, no cross-org role privilege escalationAgents already pass this across the board, which is against our typical criteria for adding benchmarks, but maybe we're okay with that here.
Preview: https://evals-git-mattrossman-ai-1006-promote-build-rls-47a093-supabase.vercel.app/?group=eval&sheet=eval&item=build-rls-003-org-roles-permissions
Closes AI-1006