# Using Postgres RLS with Ignition

**URL:** <https://forum.inductiveautomation.com/t/using-postgres-rls-with-ignition/98775>\
**Category:** Ignition\
**Tags:** database, ignition81, vision\
**Created:** [November 19, 2024, 9:41am UTC](https://forum.inductiveautomation.com/t/using-postgres-rls-with-ignition/98775 "2024-11-19T09:41:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mori.luca](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mori.luca/32/13424_2.png) [@mori.luca](https://forum.inductiveautomation.com/u/mori.luca)\
**Post date:** [November 19, 2024, 9:41am UTC](https://forum.inductiveautomation.com/t/using-postgres-rls-with-ignition/98775/1 "2024-11-19T09:41:28Z")

</div>

Hi everyone,  
I would like to try using `RLS` provided by `Postgres`.

To do so, i need to understand if there is any documentation—please kindly point it out—and how the lifecycle of a database connection works.

In the section dedicated to database connections, within the  
`connection initialization`  
there is the section  
`connection initialization commands`  
with the comment:  
`a set of commands (one per line) that will be executed each time a connection is pulled from the pool. can be used to reset environment variables.`

I am interested in understanding how and when a connection is requested/managed by the gateway, whether this connection is shared among all resources using it or if its lifecycle is limited to a single project or session.

Since what i would like to implement is a multi tenant management system using rls and not relying solely on query control,  
is there a way to dynamically pass parameters during the initialization of a **database connection** and ensure that this session is **valid only for a single vision/perspecive session** , or even better, that a **single connection is requested per query**?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [November 19, 2024, 1:37pm UTC](https://forum.inductiveautomation.com/t/using-postgres-rls-with-ignition/98775/2 "2024-11-19T13:37:44Z")

</div>

> [@mori.luca](#):
>
> shared among all resources

This. A database connection pool is a global resource. Any query operation against a DB connection uses any idle connection in the pool. A subsequent query, even on the same thread, may use a different pool connection. The only exception is when using transaction IDs in scripted queries.

> [@mori.luca](#):
>
> multi tenant management system

While Ignition's TOS now allows it, the architecture fundamentally lacks the security controls to allow different tenants to use any designer. If you are allowing any tenant to use a designer, then they have the tools to access any other tenants' data and projects.

> [@mori.luca](#):
>
> is **valid only for a single vision/perspecive session** , or even better, that a **single connection is requested per query**?

Not at all.