Totally agree. I feel it is such a powerful feature but so obscure. I have a solution up, taken from other sources, but what's actually happening behind the scenes is kinda mystery to me. Makes me anxious.
http://postgrest.org/en/v5.2/tutorials/tut1.html
http://postgrest.org/en/v5.2/auth.html
https://www.postgresql.org/docs/current/user-manag.html
https://www.postgresql.org/docs/current/ddl-rowsecurity.html