Comment by encima

Have you checked out this repo: https://github.com/supabase-community/supabase-custom-claims?

The "raw_app_meta_data" stored for a user is not writeable by the user, so you can store roles and/or privileges in there.