Yeah, I'm not bought in actually on doing the role based column security built into postgresql, at least with supabase user types. I think either a view with only the columns you want (mentioned in that article and elsewhere) or an rpc function returning a table with only the columns you want is the way to go....