I'm preparing it into a minimal open source project over the next couple of weeks. I'll post to HN when it's ready.

The simple explanation is that you set a postgres environment variable prior to each query. The Postgres row level security system looks at this variable and returns nothing if the ID in the variable does not match an ID in the table.

So I wrote a function in Django which intercepts every database query and prefixes each query with a postgres environment variable set command.

That's pretty much it.