Policy Recursion
Your database rule is chasing its own tail
Partial · ChatGPT, Pro · September 27, 2026
Pass · Claude.ai, Fable 5.1 Max · September 27, 2026
What it does
Explains why a privacy rule that looks itself up gets stuck in a loop, and fixes it without turning the privacy off.
When to use it
Postgres error 42P17, or any rule that looks up its own table.
The prompt
Paste it, then fill in the <angle brackets>
ERROR: 42P17: infinite recursion detected in policy for
relation "<table>"
The rule on <table> works out who I am by looking inside
<table>. So checking the rule sets off the rule, which sets
off the rule. It never stops.
Do NOT switch the security off. Do NOT change the rule to
using(true) — that lets everybody see everything.
1. Explain in plain words why it loops.
2. Give me the smallest database change that fixes it.
3. Explain why SECURITY DEFINER breaks the loop, and why the
helper function needs: set search_path = ''Ways to use it
- Ask which other rules have the same shape — there are usually more
- Turn the fix into a test so it cannot come back
- Use the same trick on any rule that checks itself
Test log
Each prompt was pasted into a fresh private chat with memory off and graded against pass standards written before the run (all of them, dated).
| Date | Tool | Model | Result | What happened |
|---|---|---|---|---|
| September 27, 2026 | ChatGPT | Pro | Partial | Explained the loop and both SECURITY DEFINER and search_path, but the fix re-creates the policy under the existing name without dropping it, which Postgres rejects. |
| September 27, 2026 | Claude.ai | Fable 5.1 Max | Pass | Explained the loop, fixed it with a SECURITY DEFINER helper and ALTER POLICY, and explained both SECURITY DEFINER and search_path = ''. |
The pass standard for this prompt: six criteria and an automatic-fail rule, written down on September 27, 2026, before any run.
Related words
- blast radius — How far a change can reach: every file and every behaviour it could possibly touch.
- silent regression — A change that fixes the bug you reported and quietly breaks something nearby that was working fine.
See also
- Supabase: new row violates row-level security policy — the other error a row-level security rule throws, when no policy allows the insert or update.
- Security Boundary — for writing the rules in the first place: who may see and change which rows, said in plain words and put in the database.