Fence selective authorization joins when estimates scan all history

When a PostgreSQL authorization helper joins a small protected population to large historical tables, inaccurate join estimates can select a full scan even after the small table is analyzed. Inspect the helper's inner plan separately from the outer indexed query. If the protected population is selective, LATERAL subqueries with OFFSET 0 can preserve parameterized index probes at both population-to-batch and batch-to-record boundaries. Prove multiset parity and remeasure under the real restricted caller. This is a measured choice, not a universal planner hint: probes scale with protected history, and a large protected population may favor a different plan.

Applies when: an authorization-set helper dominates latency despite indexed final row reads. Keywords: PostgreSQL authorization RLS lateral offset indexes cardinality history performance