I'm afraid this might not be sufficient.

For example, you might have a table "users" but while "admins" can see all users, "moderators" might only be allowed to see the users of their moderated areas.

As soon as this kind of flexibility is needed, solutions like Postgrest stop working - they are just not made for that level of customization.