전 저장소 리팩터링과 SSOT 정비

infra/db/init/04_audit_eval_rls.sql

@@ -321,6 +321,29 @@ CREATE POLICY p_alternative_utterance_delete ON app.alternative_utterance FOR DE
   OR app.current_role_name() IN ('admin','instructor')
 );
 
+-- ── safety_events: AI/교수자/관리자와 본인 회기의 학습자만 접근 ──
+ALTER TABLE app.safety_events ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS p_safety_events_select ON app.safety_events;
+DROP POLICY IF EXISTS p_safety_events_insert ON app.safety_events;
+CREATE POLICY p_safety_events_select ON app.safety_events FOR SELECT USING (
+  app.is_ai_context()
+  OR app.current_role_name() IN ('admin','instructor')
+  OR EXISTS (
+    SELECT 1 FROM app.sessions s
+    WHERE s.id = app.safety_events.session_id
+      AND s.learner_id = app.current_uid()
+  )
+);
+CREATE POLICY p_safety_events_insert ON app.safety_events FOR INSERT WITH CHECK (
+  app.is_ai_context()
+  OR app.current_role_name() IN ('admin','instructor')
+  OR EXISTS (
+    SELECT 1 FROM app.sessions s
+    WHERE s.id = app.safety_events.session_id
+      AND s.learner_id = app.current_uid()
+  )
+);
+
 -- ── case_profile / pinned_fact: 학습자=본인 케이스만(cross-trainee 누수 차단 T4) ──
 ALTER TABLE app.case_profile ENABLE ROW LEVEL SECURITY;
 DROP POLICY IF EXISTS p_case_select ON app.case_profile;