View permissions and row-level security in PostgreSQL

PostgreSQL Views and Row-Level Security: A Reader Question

A reader challenges a claim from a previous article about using views to grant limited access to privileged data. The question centers on whether PostgreSQL's security_invoker feature allows a role to query a view without direct table privileges.

The scenario involves a sensitive_data table and a subset_view exposing only some columns. The reader asks: can you revoke all privileges on the base table for a specific role, yet still grant SELECT on the view?

According to the reader's tests, this approach fails. Once privileges on the underlying sensitive_data table are revoked, the view returns no data — even though security_invoker is enabled, which should theoretically make the view respect the calling role's permissions.