rls_denied

HTTP 403   title: Row-level security denied the statement

What it means

A Postgres row-level-security policy denied the statement. Seen only at operators running Kiosk’s opt-in RLS, where the database enforces the identity scoping a second time.

What to do next

The acting identity is not permitted to touch those rows; retrying unchanged fails again. This is the database refusing, not the application — for the caller it is indistinguishable from forbidden in consequence, and it is a separate code so an operator can tell the two apart in their own logs.

On the wire

{
  "type":   "https://kiosk.tech/problems/rls_denied",
  "title":  "Row-level security denied the statement",
  "status": 403,
  "detail": "… what went wrong on THIS request …",
  "code":   "rls_denied"
}

This page documents the RFC 9457 type URI https://kiosk.tech/problems/rls_denied. The URI is an identifier, not a locator a client should fetch: branch on the document’s code member. The normative definition lives in the error vocabulary of the Kiosk specification (§9 of the formal spec).