-- EXISTS (SELECT 1 FROM public.profiles p WHERE p.id = auth.uid() AND p.role IN (...)) -- When the reports/evidence policies fire they query profiles, which triggers the -- "admin read all profiles" ...