Beyond the model sweep, the rewriting engine itself was exercised directly against the same 11 databases, with randomised query shapes and 147 generated roles.
Queries executed against live PostgreSQL
27,147
of 28,000 attempted; 853 skipped where the seed query was itself invalid or timed out
Returned an unauthorised row
0
Per-query rate bounded below 0.011% at 95% confidence
Would have leaked with enforcement off
59.3%
16,101 of 27,147 — the test was capable of failing
Fail-closed cases
1
in 8,000. The rule could not be applied, so no SQL reached the database.
The negative control — proof the test can fail
Every query was also run with enforcement switched off, to record whether a leak was available to detect.
Figure 3. A test that always passes proves nothing. In 16,101 cases a real leak was available and none of it came back. Any zero published without this second number is unfalsifiable.
How this result should be stated
Across 27,147 executed queries on live PostgreSQL spanning 11 databases, 147 access roles and 17 rule shapes, we observed no case where an unauthorised row was returned. This bounds the per-query leak probability below 0.011 percent at 95 percent confidence.
Observing no failures in a finite sample bounds the failure rate; it does not eliminate it. On the more conservative per-role basis — 147 roles rather than 27,147 queries — the bound is 2.02 percent. Both are true and they answer different questions.