Afaik the url method is NOT fool proof and easily circumvented. Use RLS by passing a role and a username(). You also need some method of defining which users see which accounts. Take note that using embedded rls is not very optimal either, but can be done.