Daily safety grade

All public application tables have row-level security enabled.

Limit: Enabled protection does not prove every access rule is correct.

Profiles, medications, allergies, conditions, immunizations, dose logs, consents and visibility settings have read policies; none is a literal allow-everyone rule.

Limit: This is a configuration check, not a test of every recipient or complex policy expression.

Wearable authorization states, wearable tokens and consent signing keys have row protection and no permissive visitor or signed-in read policy.

Limit: Other credentials, server code and provider settings are outside this check.

Clinical sharing and passport disclosure audit tables have row protection and no permissive client update or delete policy.

Limit: Does not verify every event was logged or validate cryptographic audit chains.

The core record tables have restrictive multi-factor rules for both reading and writing.

Limit: Checks rule presence, not a live authenticator challenge or every endpoint.