IDENTITY-TO-PERMISSION PIPELINE

Clerk Authenticated Metadata flowing into Supabase RLS policies

1. IDENTITY 2. TOKEN 3. ACCESS
Role:
STAGE 1: CLERK IDENTITY & ONBOARDING STAGE 2: FETCH HOOK & TOKEN INJECTION STAGE 3: SUPABASE ROW LEVEL SECURITY onboard jwt_claim request inject verify payload recruiter candidate CLERK_AUTH UNSAFE_METADATA FETCH_HOOK JWT_TEMPLATING API_INJECT SUPABASE_RLS RECRUITER_FLOW CANDIDATE_FLOW
1. Clerk Metadata Context
// Identity payload
{
  "user_id": "usr_2N9aBc...",
  "unsafeMetadata": {
    "role": "recruiter"
  }
}
2. Injected Supabase JWT
// Decoded App Metadata
{
  "sub": "usr_2N9aBc...",
  "role": "authenticated",
  "app_metadata": {
    "role": "recruiter"
  }
}
3. Evaluated Postgres RLS Policy
CREATE POLICY "Recruiter Access" 
ON applicant_data FOR SELECT 
TO authenticated 
USING (
  auth.jwt() -> 'app_metadata' 
  ->> 'role' = 'recruiter'
);