Supabase to require explicit GRANTs on new public tables from 30 October 2026

From 30 October 2026, Supabase will stop automatically granting table access to the anon, authenticated and service_role roles on new tables in the public schema. Existing tables will keep their current permissions, but any new table exposed through the Data API will need an explicit Postgres GRANT before apps can reach it. Supabase says the change addresses AI agents and tools creating tables without human review, which previously made it easy to expose data before securing it. Developers whose AI-built apps call public tables through the Data API may see new features fail with 401 or 403 errors, which the Supabase docs describe as a missing grant. The change is enforced on all existing projects on that date, according to Supabase's changelog.