-- ============================================================================
-- F-04: Row Level Security scharfschalten (FORCE + WITH CHECK + Kontext)
-- ============================================================================
-- Diese Migration enthält NUR SQL (keine Schemaänderung) und ist idempotent.
--
-- Ziel: Die in den bisherigen Migrationen definierten `tenant_isolation`-Policies
-- werden für die eingeschränkte App-Rolle `isms_app` (NOBYPASSRLS) wirksam.
--
-- Warum FORCE für den Owner UNSCHÄDLICH ist:
--   PostgreSQL wendet RLS auf einen Superuser bzw. eine Rolle mit BYPASSRLS NIE
--   an — auch nicht unter FORCE ROW LEVEL SECURITY. Die Owner-/Migrations-Rolle
--   `isms` ist Superuser + BYPASSRLS, sieht also weiterhin ALLE Zeilen. Deshalb
--   bleiben Migrationen, Seed und der mandantenübergreifende Login-Lookup (die
--   über `DATABASE_URL` = Owner laufen) voll funktionsfähig. FORCE greift nur für
--   `isms_app`. WICHTIG für Prod: Die Owner-/Migrate-Rolle MUSS BYPASSRLS bzw.
--   Superuser sein, sonst sähe der Login keine Nutzer (null Zeilen).
--
-- Warum WITH CHECK zwingend nötig ist (INSERT-Falle):
--   Unter FORCE ROW LEVEL SECURITY lehnt Postgres jeden INSERT/UPDATE ab, dessen
--   Zielzeile keine WITH-CHECK-Policy erfüllt. Die bisherigen Policies hatten nur
--   USING (Lesefilter), KEIN WITH CHECK → damit würde `isms_app` KEINE Zeile mehr
--   anlegen können. Jede Policy erhält deshalb hier zusätzlich
--   `WITH CHECK (tenant_id = current_setting('app.tenant_id', true))`, sodass nur
--   Zeilen des aktiven Mandanten geschrieben werden dürfen (verhindert auch das
--   „Umschreiben" einer Zeile auf einen fremden Mandanten).
--
-- Wie der Kontext gesetzt wird:
--   `current_setting('app.tenant_id', true)` liest den GUC-Parameter (2. Arg true
--   = kein Fehler, wenn ungesetzt → NULL). Die App setzt ihn TRANSAKTIONSLOKAL via
--   `SELECT set_config('app.tenant_id', <tenantId>, true)` in derselben Transaktion
--   wie die eigentliche Operation (siehe src/server/db.ts, dbForTenant, RLS-Pfad).
--   Ist der Kontext NICHT gesetzt, ergibt `tenant_id = NULL` → NULL (nicht TRUE):
--   `isms_app` sieht dann 0 Zeilen (fail-closed). Genau deshalb MUSS das
--   Scharfschalten zusammen mit der Kontextsetzung (RLS_ENFORCED=true) erfolgen.
--
-- App-Rolle / Secret (NICHT in dieser Migration):
--   `isms_app` existiert bereits (NOLOGIN, NOBYPASSRLS, mit GRANTs). Für den
--   scharfen Betrieb braucht sie LOGIN + starkes Passwort — das ist ein SECRET und
--   gehört NICHT in versioniertes SQL. Setze es operativ (einmalig), z. B.:
--     ALTER ROLE isms_app WITH LOGIN PASSWORD '<stark>';
--   und verbinde die App über RLS_DATABASE_URL als isms_app (RLS_ENFORCED=true).
--   Siehe docs/DEPLOY-PROD-CONTABO.md und .env.prod.example.
--
-- Idempotenz: ENABLE/FORCE sind idempotent; die Policy wird vor CREATE via
-- DROP POLICY IF EXISTS entfernt (deckt Gruppe A = 12 bestehende USING-only-
-- Policies und Gruppe B = 37 ohne Policy einheitlich ab).
-- ============================================================================

ALTER TABLE "asset_relations" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "asset_relations";
CREATE POLICY tenant_isolation ON "asset_relations"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "asset_relations" FORCE ROW LEVEL SECURITY;

ALTER TABLE "assets" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "assets";
CREATE POLICY tenant_isolation ON "assets"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "assets" FORCE ROW LEVEL SECURITY;

ALTER TABLE "audit_logs" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "audit_logs";
CREATE POLICY tenant_isolation ON "audit_logs"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "audit_logs" FORCE ROW LEVEL SECURITY;

ALTER TABLE "bia_entries" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "bia_entries";
CREATE POLICY tenant_isolation ON "bia_entries"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "bia_entries" FORCE ROW LEVEL SECURITY;

ALTER TABLE "measures" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "measures";
CREATE POLICY tenant_isolation ON "measures"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "measures" FORCE ROW LEVEL SECURITY;

ALTER TABLE "process_assets" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "process_assets";
CREATE POLICY tenant_isolation ON "process_assets"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "process_assets" FORCE ROW LEVEL SECURITY;

ALTER TABLE "processes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "processes";
CREATE POLICY tenant_isolation ON "processes"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "processes" FORCE ROW LEVEL SECURITY;

ALTER TABLE "risk_assets" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_assets";
CREATE POLICY tenant_isolation ON "risk_assets"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_assets" FORCE ROW LEVEL SECURITY;

ALTER TABLE "risk_measures" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_measures";
CREATE POLICY tenant_isolation ON "risk_measures"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_measures" FORCE ROW LEVEL SECURITY;

ALTER TABLE "risks" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risks";
CREATE POLICY tenant_isolation ON "risks"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risks" FORCE ROW LEVEL SECURITY;

ALTER TABLE "roles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "roles";
CREATE POLICY tenant_isolation ON "roles"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "roles" FORCE ROW LEVEL SECURITY;

ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "users";
CREATE POLICY tenant_isolation ON "users"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "users" FORCE ROW LEVEL SECURITY;

ALTER TABLE "tasks" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "tasks";
CREATE POLICY tenant_isolation ON "tasks"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "tasks" FORCE ROW LEVEL SECURITY;

ALTER TABLE "task_comments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "task_comments";
CREATE POLICY tenant_isolation ON "task_comments"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "task_comments" FORCE ROW LEVEL SECURITY;

ALTER TABLE "managed_registers" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "managed_registers";
CREATE POLICY tenant_isolation ON "managed_registers"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "managed_registers" FORCE ROW LEVEL SECURITY;

ALTER TABLE "register_rows" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "register_rows";
CREATE POLICY tenant_isolation ON "register_rows"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "register_rows" FORCE ROW LEVEL SECURITY;

ALTER TABLE "onboarding_progress" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "onboarding_progress";
CREATE POLICY tenant_isolation ON "onboarding_progress"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "onboarding_progress" FORCE ROW LEVEL SECURITY;

ALTER TABLE "wizard_facts" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "wizard_facts";
CREATE POLICY tenant_isolation ON "wizard_facts"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "wizard_facts" FORCE ROW LEVEL SECURITY;

ALTER TABLE "wizard_scopes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "wizard_scopes";
CREATE POLICY tenant_isolation ON "wizard_scopes"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "wizard_scopes" FORCE ROW LEVEL SECURITY;

ALTER TABLE "policy_package_states" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_package_states";
CREATE POLICY tenant_isolation ON "policy_package_states"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_package_states" FORCE ROW LEVEL SECURITY;

ALTER TABLE "tenant_settings" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "tenant_settings";
CREATE POLICY tenant_isolation ON "tenant_settings"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "tenant_settings" FORCE ROW LEVEL SECURITY;

ALTER TABLE "tenant_modules" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "tenant_modules";
CREATE POLICY tenant_isolation ON "tenant_modules"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "tenant_modules" FORCE ROW LEVEL SECURITY;

ALTER TABLE "supplier_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "supplier_profiles";
CREATE POLICY tenant_isolation ON "supplier_profiles"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "supplier_profiles" FORCE ROW LEVEL SECURITY;

ALTER TABLE "it_service_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "it_service_profiles";
CREATE POLICY tenant_isolation ON "it_service_profiles"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "it_service_profiles" FORCE ROW LEVEL SECURITY;

ALTER TABLE "software_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "software_profiles";
CREATE POLICY tenant_isolation ON "software_profiles"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "software_profiles" FORCE ROW LEVEL SECURITY;

ALTER TABLE "project_profiles" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "project_profiles";
CREATE POLICY tenant_isolation ON "project_profiles"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "project_profiles" FORCE ROW LEVEL SECURITY;

ALTER TABLE "supplier_assessments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "supplier_assessments";
CREATE POLICY tenant_isolation ON "supplier_assessments"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "supplier_assessments" FORCE ROW LEVEL SECURITY;

ALTER TABLE "contracts" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "contracts";
CREATE POLICY tenant_isolation ON "contracts"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "contracts" FORCE ROW LEVEL SECURITY;

ALTER TABLE "ndas" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "ndas";
CREATE POLICY tenant_isolation ON "ndas"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "ndas" FORCE ROW LEVEL SECURITY;

ALTER TABLE "supplier_evidence" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "supplier_evidence";
CREATE POLICY tenant_isolation ON "supplier_evidence"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "supplier_evidence" FORCE ROW LEVEL SECURITY;

ALTER TABLE "service_control_responsibilities" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "service_control_responsibilities";
CREATE POLICY tenant_isolation ON "service_control_responsibilities"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "service_control_responsibilities" FORCE ROW LEVEL SECURITY;

ALTER TABLE "subcontractors" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "subcontractors";
CREATE POLICY tenant_isolation ON "subcontractors"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "subcontractors" FORCE ROW LEVEL SECURITY;

ALTER TABLE "management_decisions" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "management_decisions";
CREATE POLICY tenant_isolation ON "management_decisions"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "management_decisions" FORCE ROW LEVEL SECURITY;

ALTER TABLE "maturity_assessments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "maturity_assessments";
CREATE POLICY tenant_isolation ON "maturity_assessments"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "maturity_assessments" FORCE ROW LEVEL SECURITY;

ALTER TABLE "control_assessments" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "control_assessments";
CREATE POLICY tenant_isolation ON "control_assessments"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "control_assessments" FORCE ROW LEVEL SECURITY;

ALTER TABLE "control_implementations" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "control_implementations";
CREATE POLICY tenant_isolation ON "control_implementations"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "control_implementations" FORCE ROW LEVEL SECURITY;

ALTER TABLE "policy_documents" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_documents";
CREATE POLICY tenant_isolation ON "policy_documents"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_documents" FORCE ROW LEVEL SECURITY;

ALTER TABLE "policy_requirements" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_requirements";
CREATE POLICY tenant_isolation ON "policy_requirements"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_requirements" FORCE ROW LEVEL SECURITY;

ALTER TABLE "policy_variables" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_variables";
CREATE POLICY tenant_isolation ON "policy_variables"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_variables" FORCE ROW LEVEL SECURITY;

ALTER TABLE "policy_baseline_params" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_baseline_params";
CREATE POLICY tenant_isolation ON "policy_baseline_params"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_baseline_params" FORCE ROW LEVEL SECURITY;

ALTER TABLE "policy_evidence" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "policy_evidence";
CREATE POLICY tenant_isolation ON "policy_evidence"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "policy_evidence" FORCE ROW LEVEL SECURITY;

ALTER TABLE "crypto_entries" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "crypto_entries";
CREATE POLICY tenant_isolation ON "crypto_entries"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "crypto_entries" FORCE ROW LEVEL SECURITY;

ALTER TABLE "classification_classes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "classification_classes";
CREATE POLICY tenant_isolation ON "classification_classes"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "classification_classes" FORCE ROW LEVEL SECURITY;

ALTER TABLE "handling_aspects" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "handling_aspects";
CREATE POLICY tenant_isolation ON "handling_aspects"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "handling_aspects" FORCE ROW LEVEL SECURITY;

ALTER TABLE "handling_rules" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "handling_rules";
CREATE POLICY tenant_isolation ON "handling_rules"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "handling_rules" FORCE ROW LEVEL SECURITY;

ALTER TABLE "risk_matrix_classes" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_matrix_classes";
CREATE POLICY tenant_isolation ON "risk_matrix_classes"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_matrix_classes" FORCE ROW LEVEL SECURITY;

ALTER TABLE "risk_ew_levels" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_ew_levels";
CREATE POLICY tenant_isolation ON "risk_ew_levels"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_ew_levels" FORCE ROW LEVEL SECURITY;

ALTER TABLE "risk_damage_dimensions" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "risk_damage_dimensions";
CREATE POLICY tenant_isolation ON "risk_damage_dimensions"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "risk_damage_dimensions" FORCE ROW LEVEL SECURITY;

ALTER TABLE "handbook_topics" ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON "handbook_topics";
CREATE POLICY tenant_isolation ON "handbook_topics"
  USING ("tenant_id" = current_setting('app.tenant_id', true))
  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
ALTER TABLE "handbook_topics" FORCE ROW LEVEL SECURITY;