[
  {
    "id": "M1",
    "name": "M1_account_only_table_without_rls",
    "desc": "New table with only <code>account_id</code>, no RLS, SELECT granted to the request role",
    "new": "caught: A1, A3",
    "old": "missed",
    "r1": "caught: R1"
  },
  {
    "id": "M2",
    "name": "M2_rls_on_granted_no_policy",
    "desc": "New <code>account_id</code> table, RLS on, granted, no policy",
    "new": "caught: A3",
    "old": "missed",
    "r1": "missed"
  },
  {
    "id": "M3",
    "name": "M3_institution_table_without_rls",
    "desc": "New table with <code>institution_id</code>, no RLS, granted",
    "new": "caught: A1, A3",
    "old": "caught: A1, A3",
    "r1": "caught: R1"
  },
  {
    "id": "M4",
    "name": "M4_force_rls_on_event",
    "desc": "<code>FORCE ROW LEVEL SECURITY</code> on <code>event</code>",
    "new": "caught: A2",
    "old": "caught: A2",
    "r1": "missed"
  },
  {
    "id": "M5",
    "name": "M5_audit_insert_policy",
    "desc": "An INSERT policy for the request role on <code>audit_event</code>",
    "new": "caught: A4",
    "old": "caught: A4",
    "r1": "missed"
  },
  {
    "id": "M6",
    "name": "M6_unkeyed_select_policy",
    "desc": "A <code>USING (true)</code> SELECT policy on <code>event</code>",
    "new": "caught: A5",
    "old": "caught: A5",
    "r1": "missed"
  },
  {
    "id": "M7",
    "name": "M7_person_scoped_table_without_rls",
    "desc": "New person-scoped table (<code>user_id</code> only), no RLS, granted",
    "new": "missed",
    "old": "missed",
    "r1": "caught: R1"
  },
  {
    "id": "M8",
    "name": "M8_fk_derived_table_without_rls",
    "desc": "New child table (tenancy only via FK to <code>event</code>), no RLS, granted",
    "new": "missed",
    "old": "missed",
    "r1": "caught: R1"
  }
]