Postgres RLS in Symfony: with one tenant in the fixture, your isolation suite passes with no policy at all

Ten days ago I wrote that the Postgres role which runs your migrations bypasses every row-level security policy you wrote. Mads Hansen replied with the obvious next step, and it was better than the article: run the same cross-tenant query suite twice, once as the serving role and once as the owner role, and compare. I did. It works, and I...