Its a good feature but I spent many days debugging problems caused with it.
It might have been the fault of supabase.js apis , but still not a lot of fun memories.
It's like a lot of things... process orientation and discipline early on go a long way to keeping things sane. There are nice techniques for debugging policies as well (login_as_user functions, etc). We write pgTap tests for everything, and that REALLY helps.