Chapter 19. Business Data and Retrieval: Postgres, Row-Level Security and pgvector, on Neon
In this section
- Chapter 19. Business Data and Retrieval: Postgres, Row-Level Security and pgvector, on NeonMove the connector's business data into a database, keep each company's rows apart with the database itself, and answer policy questions by meaning, with citations or an honest abstention.
- 19.1 Why a database nowWhy business data moves from files shipped with the code into a database server, and why it gets a different database from the sign-in data.
- 19.2 Tables, rows and keys, from zeroDatabases from zero: tables, rows, columns, primary and foreign keys, and how to read the three shapes of SQL query the chapter uses, with Brightline's own data.
- 19.3 Reading SQL: predict, then runRead SQL the way Chapter 13 reads code: predict, then run, with the traps that cause real bugs, how to read an error, and how to question the SQL a coding agent writes.
- 19.4 Designing the AP tablesA schema with the rules written into the database, and the company in every table and every key, so a row can only point inside its own company.
- 19.5 Third normal form in detail: keep it, break it on purposeNormal forms from zero, then third normal form in detail: find the facts stored in the wrong place, and keep the embedding as a copy on purpose, with a rule that keeps it true.
- 19.6 Changing the tables safelyNumbered migrations, applied once and in order, one database per environment, a database branch per pull request, and add before you remove.
- 19.7 Three ways to keep data apartShared tables, a schema per company or a database per company: how each keeps data apart, what it costs, and why Brightline uses shared tables with row-level security.
- 19.8 Row-level securityPolicies that the database applies to every query, default deny, who skips them, and three roles, so the connector's role can never see another company's rows.
- 19.9 One company per transactionSet the company for one transaction only, so a pooled connection never carries one company into another's query, and keep a cache from mixing companies.
- 19.10 Where the guarantee stopsSeven things that happen outside row-level security, from keys and errors to exports and logs, and the rule that closes each.
- 19.11 Each company's own rules and dataEach company's own settings, read in its own transaction, and a company's data life: loading, export and deletion, proved, with nothing stored that no tool needs.
- 19.12 Proving the data stays apartA data matrix that tries every route from one company's rows to another's, and six planted bugs, each caught by at least one check.
- 19.13 Retrieval from zeroPassages, embeddings, vectors, similarity search, a vector index and what a vector database is, from zero, with retrieval kept inside one company.
- 19.14 Embeddings and pgvector in depth: predict, then runEmbeddings and pgvector in depth, predict then run: cosine by hand, what embeddings miss (codes, amounts, negation), search by words beside search by meaning, reading a plan with EXPLAIN, what a vector costs, and how to choose passages.
- 19.15 Answers that cite, or abstainReturn passages with citations a person can check, abstain below a threshold, and let the AP expert decide which documents count.
- 19.16 Measuring retrievalA question set written with the expert, run in the build with a pass mark, and embedding again when the model changes.
- 19.17 A database behind a stateless serverA connection pool with a limit, one transaction per tool call, a time limit on connecting and on every query, and clear errors, behind a stateless server.
- 19.18 How today's tools realize itHow Neon, Hyperdrive, Workers AI, Anthropic, OpenAI and open source realize the chapter, with free plans, prices and the differences that change a decision.
- Field guide: business data and retrieval, product by productPostgres, Neon, Hyperdrive and embeddings from zero, the SQL in detail, deploying with a database, the multi-tenant data checklist, and today's tools in detail, checked November 4, 2026.
- Lab 19: Brightline's data in a databaseWith coding agents, put Brightline's and Cedar Ridge's AP data in Postgres with the company in every key and forced row-level security, move both connectors onto it, prove the data stays apart with a data matrix and six planted bugs, search policies by meaning, and deploy.
- Check yourselfRecall and practice for the whole chapter: the flashcards, sixteen questions that mix the concepts, and a final quiz round.