Hi @Jeffrey- 

Short answer: you’re not doing anything wrong—this is expected with Lakebase synced tables. UC row filters/masks don’t apply to Lakebase synced tables yet; RLS must be defined on the Postgres side separately. Synced tables are owned in Postgres by a system role (for example, databricks_writer_16400), not by the UC owner, so ALTER TABLE ... ENABLE ROW LEVEL SECURITY fails with “must be owner.

What to do

• Create a Postgres VIEW over the synced table and apply RLS to the VIEW, then point your app to the VIEW. This avoids ownership and sync conflicts and is the recommended pattern.
   
• If you need RLS on the base object, use a non-synced Lakebase table that you own or build a custom pipeline that writes directly to Lakebase so you control ownership/RLS

We expect to add more support cross lakebase <-> UC permissions in the future. 

Let me know if you'd like other work arounds!