01Confirm the request has a user session
Inspect the access token claims and confirm the browser request is authenticated when the insert runs.
What the result tells you: A null auth.uid() means the policy is evaluating an anonymous request.
ERR-743/Supabase · 42501 / RLS violation
Appears when: 42501 / RLS violation
Supabase “new row violates row-level security policy” error
The insert reached Postgres, but the active role did not satisfy an INSERT policy for the new row. Inspect the user session, table policy, and row values; do not solve this by turning RLS off.
How do I fix supabase “new row violates row-level security policy” error?
01
# Write down the intended access ruleState who may create the row and which ownership values must be present.02
# Create the narrow policyAdd or correct an INSERT policy whose WITH CHECK expression matches that rule.03
# Set trusted ownership valuesPopulate user or tenant identity from the authenticated context, not a freely editable client field.04
# Test allowed and denied casesProve both the valid insert and a cross-user or cross-tenant rejection.Preserve the current working revision, change one proven boundary, and verify the published path in a clean session.
What if the quick fix does not work?
02Read the INSERT policy
Check the WITH CHECK expression for the active role and table. It must be true for the row being inserted.
What the result tells you: A policy scoped to authenticated users still fails when ownership fields do not match the user id.
03Inspect the new row values
Verify owner_id, tenant_id, and other policy fields are populated before the insert.
What the result tells you: A missing ownership value often explains why a reasonable policy rejects the write.
| Likely cause | What proves it | First safe action |
|---|---|---|
| No matching INSERT policy | A null auth.uid() means the policy is evaluating an anonymous request. | Write down the intended access rule |
| Session is missing or stale | A policy scoped to authenticated users still fails when ownership fields do not match the user id. | Create the narrow policy |
| Ownership field is wrong | A missing ownership value often explains why a reasonable policy rejects the write. | Set trusted ownership values |
| Policy targets another role | A null auth.uid() means the policy is evaluating an anonymous request. | Test allowed and denied cases |
Why do AI-built apps hit this problem?
The insert reached Postgres, but the active role did not satisfy an INSERT policy for the new row. Inspect the user session, table policy, and row values; do not solve this by turning RLS off.
No matching INSERT policy
RLS is enabled but the active role has no policy that permits the new row.
Session is missing or stale
The insert runs before authentication is established or with an expired token.
Ownership field is wrong
The policy compares auth.uid() to a null or different user or tenant value.
When the built-in AI fix makes it worse
Freeze generated changes, restore the last known working version, reproduce one request, collect the browser and platform logs, and change one layer at a time.
How do I stop this problem recurring?
- →Treat every new table as incomplete until SELECT, INSERT, UPDATE, and DELETE behavior is explicitly decided.
- →Add policy tests for owner, non-owner, anonymous, and service roles.
- →Keep production configuration in an explicit release checklist, not in chat history.
- →Test the published URL in a clean browser session before calling the release complete.
- →Keep a last-known-good deployment and a documented rollback step.
- →Log the critical request path with enough context to identify the failing layer.
Still stuck with supabase “new row violates row-level security policy” error?
AI prototype hardeningWe restore the critical path and document the root cause.
- Production failure reproduced with evidence
- The smallest responsible layer repaired
- Rollback and prevention guidance included
Supabase “new row violates row-level security policy” error questions
Can I disable RLS to make the insert work?+
That removes the security boundary instead of repairing it. Keep RLS enabled and correct the session, policy, or row ownership data.
What does WITH CHECK do?+
For INSERT and relevant UPDATE operations, it determines whether the new row is allowed by the policy.
Why does the service role work?+
A server-side service role has elevated privileges. Its success does not prove that a browser user should be allowed to perform the same write.