Not sure having both an array column and then json objects is going to be the best way to handle RLS lookups and updates performance and sanity wise. If you need to though, you should focus on generating a straight SQL query and testing that before you worry about putting it in an RLS statement. RLS policy is just a where with SQL. Postgres has array and json/b operators and functions that can do almost anything you could want. Just google those to get started.