Sure, but it's the same with pretty much any other app architecture.

Either your app has all the data access and you put your access control there, or you do the access control in the database. There really aren't other options here. There isn't access control defense in depth here. The best you can really do is do some data encryption of the data in the tables. We do some of that, but it's such a PITA that we relegate it to special stuff only.

> especially as SSO is rarely implemented with one policy - there's device attestation, 2FA, etc.

Sure but ALL of that relies on the SSO system behaving as advertised, so you think of it as separate policies, but it really isn't. It's once SSO CVE away from giving away the store. We use SSO with PG, that's how they authenticate to PG, we are fans of SSO too.

Most companies, or at least the ones I've worked at, don't use row level security at all. Instead, the application just accesses the multi tenant database.

It's absolutely littered with broken access control vulnerabilities. You have to remember to put the user key and group in every query across the entire application. And then there's dynamic queries and ORMs, which make everything worse. Now you cant even audit the source code, you have to observe behavior.

Most people don't know their applications have these vulnerabilities, but they're very common.