When To Use RLS vs Application Permissions
Application checks are useful. Database policy is better for tenant boundaries that must survive new code paths.
Application permissions are not enough
Route checks are easy to understand, and they belong in the app. But tenant boundaries should not depend on every future route remembering the same filter.
That is where Row Level Security earns its keep.
The Apex rule
The application authenticates the user and sets request context. The database decides what rows that user can see.
This makes the system less flexible in a good way. New routes have to pass through the same boundary.
When I would not use RLS
RLS is not magic. For single-tenant apps, simple internal tools, or data with no cross-account boundary, application permissions may be enough.
Use RLS when a missed filter becomes a data leak.