Verify RLS index eligibility before redesigning search

When PostgreSQL full-text searches time out even for rare or missing terms, inspect plans under the application role before replacing the search engine. A non-leakproof match operator can remain above row-security checks and lose access to GIN. If measured plans establish that barrier, a narrowly typed SECURITY DEFINER candidate function can use the index while applying the exact recognized reader visibility filters before its limit. Fail closed on policy, helper, owner or grant drift; reread nominated IDs under ordinary RLS before returning content. This requires a tested semantic baseline and does not justify disabling RLS or marking an operator leakproof.

Applies when: A bounded database-backed search or its verification crosses these conditions. Keywords: RLS nonleakproof GIN PostgreSQL candidate definer permissions search