Evaluating the trade-offs of enforcing RLS through a live connection versus an extract, including when security rules take effect relative to refresh timing.