--- collection: serverless-postgres collection_name: Serverless Postgres week_start: 2026-07-27 title: Permissions, agents, and access control reshape the serverless Postgres landscape release_count: 60 generated: 2026-08-03 canonical: https://releases.sh/collections/serverless-postgres/digest/2026-07-27 --- # Permissions, agents, and access control reshape the serverless Postgres landscape Neon introduced project-level permissions and Supabase open-sourced an AI agent benchmark, while both Supabase and PlanetScale shipped security and diagnostics improvements that tighten how developers and tools interact with their databases. ### Granular access arrives on Neon and Supabase The most consequential change this week is Neon's launch of [project-level permissions](/release/rel_yWzX32pbcgUejHxZG3sFF-neon-introduces-project-level-permissions-and-adds-backend-guides), letting you assign Viewer, Editor, or Admin roles on individual projects rather than across the entire organization. The new Collaborator organization role defaults to zero access until specific projects are granted, which teams with mixed-sensitivity databases will appreciate. Existing organizations are migrated automatically. Supabase took a different approach to access control: [Sign in with ChatGPT](/release/rel_Mvj0q03tcmlx3SA4dgdOY-supabase-launches-sign-in-with-chatgpt-beta) entered beta, letting you authenticate to supabase.com with your ChatGPT account and connect Supabase inside ChatGPT and Codex with one click. Existing accounts with matching emails are linked automatically. This removes friction for developers who build with AI assistants, but it also signals a broader shift toward identity federation as a product differentiator. ### Durable diagnostics and agent benchmarking PlanetScale gave operators two new CLI tools for understanding database behavior. The [pscale insights](/release/rel_dHogcRDfteRDj1g10N_3R-planetscale-cli-adds-pscale-insights-and-inspect-for-database-diagnostics) command runs server-side analysis of production traffic to surface top queries, error patterns, resource anomalies, and schema recommendations, while `pscale inspect` provides live point-in-time checks over a read-only connection. Both support JSON output for scripting. Vitess users also gained [query request size metrics](/release/rel_2oDZN9z0yPh4HG1GRVCJg-planetscale-insights-adds-vitess-query-request-size-metrics) — bytes received, bytes received per query, and max bytes received per query — pairing with existing bytes-returned columns to show two-way network traffic. Supabase open-sourced [supabase/evals](/release/rel_mU1KqJS-30qulhCphEd9h-supabase-open-sources-ai-agent-benchmark-and-evals-framework), a benchmark and framework for testing how well coding agents like Claude Code and Codex build with Supabase. It runs agents against real tasks — debugging Edge Functions, fixing RLS policies, building schemas — and scores performance. This is as much a recruitment tool for better agent-powered workflows as it is a transparency play. ### Security hardening across the stack Supabase's CLI v2.111.0-beta.3 now [revokes PUBLIC privileges by default](/release/rel_QIp395VPJB2HozmAK38aX-supabase-cli-v2-111-0-beta-3-revokes-public-privileges-by-default-in-pg-delta) in pg-delta, closing a common misconfiguration where new tables are accessible to every role. The JS client SDK moved [OpenTelemetry tracing to an opt-in /tracing subpath](/release/rel_fCNb2n3ZCBtby1ROoMrL2-supabase-js-client-sdk-v2-112-0-canary-0-moves-opentelemetry-tracing-to-opt-in) in both canary and beta releases, reducing bundle size for non-tracing users. The client also [stores PKCE verifiers in per-flow slots](/release/rel_FkA1CMcvPCNdf-g88JbIv-supabase-client-sdk-v2-111-0-stores-pkce-verifiers-in-per-flow-slots-to-survive) to prevent overlapping authentication flows from silently overwriting each other. PlanetScale published [SOC 1 Type 2 and SOC 2 Type 2 + HIPAA reports](/release/rel_KgqbndObKHcqgzApwKTPU-planetscale-publishes-soc-1-type-2-and-soc-2-type-2-reports-for-2026) covering June 2025 to June 2026, available through their Trust Center. And the Neon changelog also brought [roaringbitmap extension support](/release/rel_MudMFSxjfBNqJ8vB-LV8t-planetscale-for-postgres-adds-roaringbitmap-extension-for-compressed-bitmap) for compressed bitmap operations — not a security change, but a nice addition for any analytic workload that needs efficient set operations. ### CLI polish and ecosystem connections The Supabase CLI saw a flurry of fixes across the week: bulk function deployments now [continue past individual failures](/release/rel_qCy4-_rHYzO1I9TD9Iyl6-supabase-cli-v2-111-0-makes-function-deployments-fault-tolerant-and-improves) and always sync metadata, database connection failures [surface root cause details](/release/rel_1aPfeQUo0KRSJC5VtThRu-supabase-cli-v2-110-1-beta-3-surfaces-db-connection-failure-details) instead of generic errors, and the `--debug` flag [preserves TLS](/release/rel_AL_n21VTD62hz4BRKWXMF-supabase-cli-v2-111-0-beta-10-keeps-tls-under-debug) instead of disabling it. The Neon update also included schema-qualified table names in the MCP server and a Drizzle Studio 1.5.1 update with multi-column sorting and keyboard shortcuts, while the [Supabase Auth admin list endpoint](/release/rel_IUqIlXI_RTfysCu151YBW-supabase-auth-v2-194-0-adds-cursor-based-pagination-for-admin-users-list) gained cursor-based pagination for managing large user bases. ## Releases covered ### Neon - [Neon introduces project-level permissions and adds backend guides](https://releases.sh/release/rel_yWzX32pbcgUejHxZG3sFF-project-level-access-controls-ship-existing-orgs-migrate-automatically) ### PlanetScale - [PlanetScale CLI adds pscale insights and inspect for database diagnostics](https://releases.sh/release/rel_dHogcRDfteRDj1g10N_3R-pscale-insights-and-inspect-diagnose-databases-from-the-cli) - [PlanetScale Insights adds Vitess query request size metrics](https://releases.sh/release/rel_2oDZN9z0yPh4HG1GRVCJg-query-insights-tracks-request-size-with-3-new-columns) - [PlanetScale publishes SOC 1 Type 2 and SOC 2 Type 2 reports for 2026](https://releases.sh/release/rel_KgqbndObKHcqgzApwKTPU-soc-1-and-soc-2-type-2-reports-available-for-2025-2026) - [PlanetScale for Postgres adds roaringbitmap extension for compressed bitmap operations](https://releases.sh/release/rel_MudMFSxjfBNqJ8vB-LV8t-roaringbitmap-extension-now-available-for-postgres) ### Supabase - [Supabase launches Sign in with ChatGPT beta](https://releases.sh/release/rel_Mvj0q03tcmlx3SA4dgdOY-sign-in-with-chatgpt-beta-one-click-supabase-connection-in-chatgpt) - [Supabase open-sources AI agent benchmark and evals framework](https://releases.sh/release/rel_mU1KqJS-30qulhCphEd9h-ai-agent-benchmark-framework-open-sourced) - [Supabase CLI v2.111.0-beta.3 revokes PUBLIC privileges by default in pg-delta](https://releases.sh/release/rel_QIp395VPJB2HozmAK38aX-default-pg-delta-version-revokes-public-privileges) - [Supabase JS Client SDK v2.112.0-canary.0 moves OpenTelemetry tracing to opt-in subpath](https://releases.sh/release/rel_fCNb2n3ZCBtby1ROoMrL2-opentelemetry-tracing-now-opt-in-under-tracing-subpath) - [Supabase Client SDK v2.111.0 stores PKCE verifiers in per-flow slots to survive overlapping flows](https://releases.sh/release/rel_FkA1CMcvPCNdf-g88JbIv-pkce-verifiers-survive-overlapping-auth-flows) - [Supabase CLI v2.111.0 makes function deployments fault-tolerant and improves error messages](https://releases.sh/release/rel_qCy4-_rHYzO1I9TD9Iyl6-fault-tolerant-function-deploys-go-cli-aligned-error-messages) - [Supabase CLI v2.110.1-beta.3 surfaces DB connection failure details](https://releases.sh/release/rel_1aPfeQUo0KRSJC5VtThRu-db-connection-errors-now-show-root-cause-detail) - [Supabase CLI v2.111.0-beta.10 keeps TLS under --debug](https://releases.sh/release/rel_AL_n21VTD62hz4BRKWXMF-tls-retained-under-debug-flag) - [Supabase Auth v2.194.0 adds cursor-based pagination for admin users list](https://releases.sh/release/rel_IUqIlXI_RTfysCu151YBW-admin-users-list-now-supports-cursor-based-pagination)