SAMPLE EVIDENCE for AR-03 (made-up app Tidyhaus; not a real review)

Policy on public.profiles, FOR UPDATE: USING (id = auth.uid()), WITH CHECK (id = auth.uid()). No trigger or column grant protects 'role'.