Dan Lynch

CEO at @constructive_io | 2x Exited Founder | Founded Brandcast (acq. by TIME), (acq. by AMZE), @Mathapedia | @UCBerkeley EECS & Haas

[Dan Lynch @danlynch]

Been thinking about this a lot after reading @deseventral's thread...

Everyone’s racing to build smarter agents. We’ve been focused on something different: building codegen tools that help humans + agents converge on trustworthy, secure systems together.

[Dr. Steven Waterhouse @deseventral]

1/ There's a bottleneck in AI that hundreds of billions of dollars can't buy past: the very few people who can wield this technology well enough to matter.

There aren't nearly enough of them, and the entire buildout runs through them.

[Dan Lynch @danlynch]

@shadcn cc @phatggg

[Grant Lee @thisisgrantlee]

https://t.co/cIfFSrnv7Z

[Dan Lynch @danlynch]

@buchmanster 😅

[Dan Lynch @danlynch]

If your security model requires every engineer, every microservice, every agent, every job, and every future developer to remember the correct access-control filter every time, that's not a security model. PostgreSQL RLS exists specifically to eliminate that class of failure.

[Dan Lynch @danlynch]

PostgreSQL RLS is the security equivalent of moving invariants into the compiler. Instead of hoping every API endpoint remembers to add WHERE tenant_id = ?, the database proves it on every query. Fewer places to make mistakes. Smaller attack surface. Better security model.

[Dan Lynch @danlynch]

The strongest argument for PostgreSQL RLS isn't convenience. It's non-bypassability. An application-layer check can be forgotten. A database-enforced policy applies regardless of which API, service, script, agent, cron job, migration, or developer issued the query.

[Dan Lynch @danlynch]

One thing I love about PostgreSQL is that security features are built by database people, not bolted on by application devs later. The engineers behind RLS spent 10, 20, even 25+ years on PostgreSQL internals. That's a very different level than "we added some middleware."

[Dan Lynch @danlynch]

@samlambert @gwenshap RLS enforces least privilege at query-time. The DB itself refuses unauthorized rows. One bug or missing filter in the app can’t override it.

[Dan Lynch @danlynch]

@samlambert @gwenshap RLS predicates become part of the SQL plan via security barriers, so they’re atomic with each query and always applied

[Dan Lynch @danlynch]

@convex @mikeysee RLS is a very robust technology, it is EASY to get wrong as a developer.

Therefore, sounds like as you suggest in your video, RLS itself does not suck, but it hard to get right.

There are also downsides to having access logic in application code

[Dan Lynch @danlynch]

@jamesacowling Even experienced developers do have issues with it - which is why we built a platform for RLS specifically. Application based security is a fix but definitely not as robust by definition

[Dan Lynch @danlynch]

Vibing on @Stanford campus today so I can join @Kristopherfloyd and the Frontier Research Club ⚡️

[Dan Lynch @danlynch]

damn, we need a post mortem.

[jinjingliang @JinjingLiang]

@SocketSecurity Please stop, I'm running out room.

[Dan Lynch @danlynch]

@phatggg Lollllll

[Dan Lynch @danlynch]

😂

[Dan Lynch @danlynch]

Friday on the Bay 😎

[Dan Lynch @danlynch]

@buchmanster Nice!!! I'm super curious about the stack