Supabase Agent Skills has a real gap: parallel tool calls for different users all hit service_role JWT, RLS sees one identity. Fix in prod: set_config('app.user_id', claim, true) per-request policy on that claim instead of JWT sub. Breaks with naive pgBouncer tho.