---
title: "Are Supabase docs agent-friendly? We didn't know, so we checked"
description: "Supabase found that coding agents increasingly use its documentation to configure projects, creating risks when pages omit or bury critical instructions. To measure this, the team built an evaluation for the Row Level Security (RLS) guide, running an agent through realistic tasks and grading outcomes with checklist-based and agent-based judges. The initial runs found unauthenticated anon access with write privileges across tables and showed that test guidance was skipped when separated from the policy code. Supabase responded by adding procedural revocation steps, explicit policy snippets, and colocated test examples; the eval then passed the affected checks. The project concludes that agents and humans both benefit from selective-reading-aware structure, clear sections, explicit signposting, and recurring documentation evaluations, with the RLS scenario moving into the public supabase/evals benchmark."
---

# Are Supabase docs agent-friendly? We didn't know, so we checked

[Supabase](https://yomu.fyi/company/supabase) · miranda\_limonczenko,nik\_richers · Aug 1, 2026

**Type:** Problem & solution

## Summary

Supabase found that coding agents increasingly use its documentation to configure projects, creating risks when pages omit or bury critical instructions. To measure this, the team built an evaluation for the Row Level Security (RLS) guide, running an agent through realistic tasks and grading outcomes with checklist-based and agent-based judges. The initial runs found unauthenticated anon access with write privileges across tables and showed that test guidance was skipped when separated from the policy code. Supabase responded by adding procedural revocation steps, explicit policy snippets, and colocated test examples; the eval then passed the affected checks. The project concludes that agents and humans both benefit from selective-reading-aware structure, clear sections, explicit signposting, and recurring documentation evaluations, with the RLS scenario moving into the public supabase/evals benchmark.

## Context

Coding agents are being pointed at Supabase documentation to complete setup tasks, but agents may miss buried or missing instructions and cannot reliably recognize security mistakes. The team specifically evaluated the high-traffic Row Level Security guide because incorrect RLS configuration can expose data without producing an error.

## Approach / What changed

The team created an eval that runs an agent through realistic database-setup tasks and grades results with checklist-based checks and broader agent judgments. The RLS checklist was derived from subject-matter expertise, internal training, other documentation, and outside sources rather than from the guide alone. After identifying failures, they added grant-revocation steps, explicit policy snippets, and test examples beside the policy code, then repeated the evaluation.

## Takeaways

- The first RLS runs granted anon insert, update, delete, and truncate privileges across the todo, list, membership, item, weather-station, and weather-reading tables.
- Moving test examples next to the policy code fixed an eval failure caused by agents selectively reading the page instead of following every section.
- The RLS scenario is moving from an internal regression suite into the public supabase/evals benchmark, alongside expansion to other popular guides.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Documentation](https://yomu.fyi/topic/documentation), [Security](https://yomu.fyi/topic/security), [Testing](https://yomu.fyi/topic/testing)

- Source: [Supabase](https://supabase.com/blog/are-supabase-docs-agent-friendly)
- Source URL: https://supabase.com/blog/are-supabase-docs-agent-friendly
- Ingested by Yomu: 2026-09-03T12:00:55.313Z

[Read original post](https://supabase.com/blog/are-supabase-docs-agent-friendly)