It is easy to treat RLS as a checklist item: turn it on, add auth.uid(), ship. That pattern is right for “my own rows” and wrong for a public blog.
Reads vs writes
Anyone can read posts and comments. Inserts are scoped to the signed-in author. Updates and deletes allow the author or an admin helper that reads profiles.is_admin, not JWT user metadata.
The detail that bites people: an UPDATE still needs a matching SELECT policy. Without it, Postgres returns zero rows and looks like a silent no-op.