Apply SELECT policies if RETURNING has cols

[rmloveland]

Fixes DOC-13890

[netlify]

✅ Deploy Preview for cockroachdb-api-docs canceled.

Name	Link
🔨 Latest commit	8e17bde
🔍 Latest deploy log	https://app.netlify.com/projects/cockroachdb-api-docs/deploys/685daa8785a4bf0008d68127

[netlify]

✅ Deploy Preview for cockroachdb-interactivetutorials-docs canceled.

Name	Link
🔨 Latest commit	8e17bde
🔍 Latest deploy log	https://app.netlify.com/projects/cockroachdb-interactivetutorials-docs/deploys/685daa8751e8770008994dc8

[github-actions]

Files changed:

• src/current/v25.2/create-policy.md
• src/current/v25.3/create-policy.md

[netlify]

✅ Netlify Preview

Name	Link
🔨 Latest commit	8e17bde
🔍 Latest deploy log	https://app.netlify.com/projects/cockroachdb-docs/deploys/685daa87c0bc460008b4b977
😎 Deploy Preview	https://deploy-preview-19720--cockroachdb-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[rmloveland]

thanks for the review comments @spilchen , I've taken a shot at updating based on your latest feedback, PTAL

[spilchen]

Looks good. Thanks for revising.

One minor comment, but I'll leave it to you if you want to apply it: I'm wondering if you want to reverse the definition of ✓(b) and ✓(a) since the description of ✓(a) references ✓(b)?

Something like:

• ✓: Always applied.
• (a): A USING policy failure causes the statement to fail. Normally, USING filters out rows silently.
• (b): Like ✓(a), but only applied when the statement references row columns (WHERE, SET, or RETURNING). If the policy is violated, the statement fails.

[rmloveland]

Looks good. Thanks for revising.

Thank YOU for reviewing!

One minor comment, but I'll leave it to you if you want to apply it: I'm wondering if you want to reverse the definition of ✓(b) and ✓(a) since the description of ✓(a) references ✓(b)?

Something like:

• ✓: Always applied.
• (a): A USING policy failure causes the statement to fail. Normally, USING filters out rows silently.
• (b): Like ✓(a), but only applied when the statement references row columns (WHERE, SET, or RETURNING). If the policy is violated, the statement fails.

Yes I think that's way clearer! Have swapped (a) and (b) the footnotes and also in the table cells in 805ac45

[taroface]

One nit, and I'd like to suggest an edit to the part below the bullets, but I need some help understanding it.

[rmloveland]

thanks for the reviews! rebased on main to pick up the v25.3 docs and ported the changes from this PR convo to v25.3 as well