git:20260519.7b28ce1 to git:20260520.ff62120

10 added, 13 removed. Audit A to A.

---

name: preset-embedded-rls

- description: Review and prepare row-level security clauses for direct API Preset embedded analytics and guest-token workflows. Use only for direct API workflows when a user asks for embedded RLS, tenant filters, guest-token RLS rules, or external viewer data isolation. Do not use for MCP-only work.

+ description: Review embedded analytics row-level security clauses, tenant filters, guest-token RLS rules, and external-viewer isolation for direct API workflows. Use only for direct API workflows; Do not use for MCP-only work.

---

# preset-embedded-rls

- Use this skill for embedded row-level security review before guest-token creation.

+ Use before guest-token creation when embedded viewers need row-level security.

- ## Workflow

+ ## Always

- 1. Use `preset-api` first: load its authentication reference and create the reusable Python client as `client`.

- 2. Use `preset-workspaces` to resolve the workspace hostname as `hostname`.

- 3. Use `preset-superset` and `preset-datasets` to inspect relevant dataset metadata when the user asks to validate available columns.

- 4. Load [references/embedded-rls-rules.md](references/embedded-rls-rules.md) before preparing any embedded RLS clause.

- 5. Route token issuance to `preset-guest-tokens` after the RLS rules are explicit.

+ - Use `preset-api`, `preset-workspaces`, and metadata skills only when column validation is required.

+ - Do not invent tenant identifiers, filters, dataset columns, or access rules.

+ - Treat RLS clauses as permission controls that can leak or hide customer data.

+ - Confirm every clause and intended viewer population before token creation.

+ - Do not validate with broad data-returning queries unless the user approves target and limit.

- ## Guardrails

+ ## Retrieve

- - Do not invent tenant identifiers, account filters, dataset columns, or access rules.

- - Treat RLS clauses as permission controls. Incorrect clauses can leak or hide customer data.

- - Confirm every clause and intended viewer population before token creation.

- - Do not validate RLS by running broad data-returning queries unless the user explicitly approves the target and limit.

+ - Embedded RLS rule design and review: [references/embedded-rls-rules.md](references/embedded-rls-rules.md)