Postgres RLS policies are excellent at scoping what a role can see and change. Many agent stacks lean on them as the last line of defense once write tools are enabled.
After a bad write inside the allowed tenant, RLS still did its job. The missing answer is
whether anyone authorized that exact statement for that agent_id.
Different failure modes
Cross-tenant leak → RLS / tenancy. Unattested mutate inside a tenant → statement authorize. Shipping only one control leaves the other hole open.
Keep RLS. Add a receipt at the mutate boundary. Isolation and permission are complementary.
If this is your write path
Feel a DENY on Challenge, Graduate Exact $100 for provenance, or evaluate Gateway for standing control.