# Row level policies for non-SPA?
**URL:** https://discuss.ihp.digitallyinduced.com/t/row-level-policies-for-non-spa/85
**Category:** General
**Created:** [July 3, 2025, 12:08pm UTC](https://discuss.ihp.digitallyinduced.com/t/row-level-policies-for-non-spa/85 "2025-07-03T12:08:55Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@kbu](https://discuss.ihp.digitallyinduced.com/u/kbu)
#### Post date: [July 3, 2025, 12:08pm UTC](https://discuss.ihp.digitallyinduced.com/t/row-level-policies-for-non-spa/85/1 "2025-07-03T12:08:55Z")
I see discussion of row-level policies on [realtime SPAs](https://ihp.digitallyinduced.com/Guide/realtime-spas.html#defining-a-security-policy) in The Guide, but does it not make sense to define policies also when server-side rendering? E.g. letting secret\_diary\_entries only be visible if `user_id = ihp_user_id()` and public\_profile\_pages only be writable where `user_id = ihp_user_id()` ?
---
### Author:  [@marc](https://discuss.ihp.digitallyinduced.com/u/marc)
#### Post date: [July 8, 2025, 9:26am UTC](https://discuss.ihp.digitallyinduced.com/t/row-level-policies-for-non-spa/85/2 "2025-07-08T09:26:16Z")
This is supported by IHP.
Check out this function:
[https://ihp.digitallyinduced.com/api-docs/IHP-LoginSupport-Helper-Controller.html#v:enableRowLevelSecurityIfLoggedIn](https://ihp.digitallyinduced.com/api-docs/IHP-LoginSupport-Helper-Controller.html#v:enableRowLevelSecurityIfLoggedIn)
---
### Author:  [@kbu](https://discuss.ihp.digitallyinduced.com/u/kbu)
#### Post date: [July 8, 2025, 12:21pm UTC](https://discuss.ihp.digitallyinduced.com/t/row-level-policies-for-non-spa/85/3 "2025-07-08T12:21:29Z")
Aha, that’s pretty cool. Is there any reason _not_ to enable that?
---
### Author:  [@marc](https://discuss.ihp.digitallyinduced.com/u/marc)
#### Post date: [July 8, 2025, 1:01pm UTC](https://discuss.ihp.digitallyinduced.com/t/row-level-policies-for-non-spa/85/4 "2025-07-08T13:01:35Z")
Sometimes you want to do queries that are global, e.g. let’s say you want to display the count of all users that created an account. With `enableRowLevelSecurityIfLoggedIn` enabled, it will always show `1` (assuming the RLS policy allows the user only to see himself).
For that there’s also [IHP.ModelSupport](https://ihp.digitallyinduced.com/api-docs/IHP-ModelSupport.html#v:withRowLevelSecurityDisabled) to disable the RLS scope for a specific code block.