flask-rls: Postgres Row-Level Security That Survives the Connection Pool

Sat, 01 Aug 2026 10:00:00 +0530

After I built django-rls, the obvious question was whether the idea belonged to Django at all. It doesn’t. “Let PostgreSQL enforce tenant isolation instead of trusting every developer to remember a .filter()” is a database argument, not a framework argument. So I ported it: flask-rls is the Flask/SQLAlchemy sibling — same concepts, same policy names, same fail-closed philosophy — rebuilt on SQLAlchemy Core and the Flask request lifecycle. It’s on PyPI as flask-rls (BSD-3-Clause), with docs at flask-rls.com, and it runs on Python 3.10+, SQLAlchemy 2.0+, Flask 2.2+, and PostgreSQL 12+.

Flask on Kuldeep Pisda

flask-rls: Postgres Row-Level Security That Survives the Connection Pool