fix(security): enforce defensive RLS for agent chat tables

Close Supabase advisor findings by enabling RLS and deny-by-default policies on new public agent-chat tables. Clarify backend RLS governance and incident runbook steps to prevent config-drift regressions.

backend/AGENTS.md

@@ -104,8 +104,20 @@ Use `schemas / repository / service` pattern:
 - Migrations must be reversible; no reliance on generated IDs
 
 ### RLS Guidance
-- Backend does not rely on RLS for correctness (uses service_role)
-- **Backend-only tables**: RLS optional (skip to reduce maintenance)
-- **Client-direct tables**: must enable RLS with policies covering select/insert/update/delete
-- `alembic_version` must not be exposed to anonymous clients (revoke anon access)
-- Business tables that may be exposed to clients should enable defensive RLS even if the backend does not depend on it
+- Backend does not rely on RLS for correctness (uses service_role), but RLS is mandatory as a defensive boundary for tables in PostgREST-exposed schemas.
+- **Mandatory default**: any new business table in `public` must enable RLS in the same Alembic migration.
+- The same migration must create policies covering `SELECT/INSERT/UPDATE/DELETE` (minimum requirement).
+- Recommended default policy set for `anon, authenticated`: deny all operations first, then open explicit access only when required.
+- `alembic_version` must not be exposed to `anon` or `authenticated`.
+
+#### Exemption Rule (strict)
+- Exemptions are allowed only when a new `public` table is guaranteed not to be exposed to PostgREST clients.
+- Exemptions must be explicit in the migration file with rationale and verification notes (why safe, how exposure is prevented).
+- If exposure is uncertain, do not exempt: enable defensive RLS by default.
+
+#### Migration Acceptance Checklist (RLS)
+- [ ] New `public` business table has `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` in migration
+- [ ] Policies for `SELECT/INSERT/UPDATE/DELETE` are present in migration
+- [ ] Policy target roles are explicit (`anon`, `authenticated`, or both)
+- [ ] Downgrade path is reversible and does not silently weaken intended production security
+- [ ] Any exemption is documented with clear non-exposure evidence

backend/alembic/versions/20260226_enable_rls_for_agent_chat_tables.py

@@ -0,0 +1,58 @@
+"""enable_rls_for_agent_chat_tables
+
+Revision ID: 20260226_agent_chat_rls
+Revises: 20260226_agent_chat_core
+Create Date: 2026-02-26 18:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+
+revision: str = "20260226_agent_chat_rls"
+down_revision: Union[str, Sequence[str], None] = "20260226_agent_chat_core"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+TABLES = ("llm_factory", "llms", "sessions", "messages")
+
+
+def _enable_rls_and_deny_public(table: str) -> None:
+    op.execute(f"ALTER TABLE public.{table} ENABLE ROW LEVEL SECURITY")
+    op.execute(
+        f"CREATE POLICY {table}_deny_public_select ON public.{table} "
+        "FOR SELECT TO anon, authenticated USING (false)"
+    )
+    op.execute(
+        f"CREATE POLICY {table}_deny_public_insert ON public.{table} "
+        "FOR INSERT TO anon, authenticated WITH CHECK (false)"
+    )
+    op.execute(
+        f"CREATE POLICY {table}_deny_public_update ON public.{table} "
+        "FOR UPDATE TO anon, authenticated USING (false) WITH CHECK (false)"
+    )
+    op.execute(
+        f"CREATE POLICY {table}_deny_public_delete ON public.{table} "
+        "FOR DELETE TO anon, authenticated USING (false)"
+    )
+
+
+def _disable_rls_and_drop_policies(table: str) -> None:
+    op.execute(f"DROP POLICY IF EXISTS {table}_deny_public_select ON public.{table}")
+    op.execute(f"DROP POLICY IF EXISTS {table}_deny_public_insert ON public.{table}")
+    op.execute(f"DROP POLICY IF EXISTS {table}_deny_public_update ON public.{table}")
+    op.execute(f"DROP POLICY IF EXISTS {table}_deny_public_delete ON public.{table}")
+    op.execute(f"ALTER TABLE public.{table} DISABLE ROW LEVEL SECURITY")
+
+
+def upgrade() -> None:
+    for table in TABLES:
+        _enable_rls_and_deny_public(table)
+
+
+def downgrade() -> None:
+    for table in reversed(TABLES):
+        _disable_rls_and_drop_policies(table)