Most PostGraphile projects have two or three PostgreSQL roles total, and that can support millions of application users. This is such a common misconception that we created an infosheet about it: https://learn.graphile.org/docs/PostgreSQL_Row_Level_Securit...