Auditing in Java systems: RLS in the database or application-level control?

This question comes up in every project dealing with sensitive data. And the honest answer is: it depends — but there are clear criteria to decide. Let me get straight to the point. What is RLS-based auditing? Row Level Security is a native PostgreSQL feature that filters and restricts row access directly in the database, using declarative policies. -- Enable RLS on the table ALTER TABLE transactions ENABLE ROW LEVEL SECURITY ; ALTER TABLE transactions FORCE ROW LEVEL SECURITY ; -- Policy: user only sees records from their own company CREATE POLICY tenant_isolation ON transactions USING ( company_id = current_setting ( 'app.tenant_id' ):: uuid ); -- Audit trigger that captures session context CREATE OR REPLACE FUNCTION fn_audit () RETURNS TRIGGER AS $$ BEGIN INSERT INTO audit_log ( table_name , operation , user_id , data_before , data_after ) VALUES ( TG_TABLE_NAME , TG_OP , current_setting ( 'app.user_id' , true ):: uuid , CASE WHEN TG_OP = 'DELETE' THEN to_jsonb ( OLD ) END , CASE WH