From what I can see this doesn't contain any kind of permission model, or authentication. At least what I could see in the documentation. I would say that RLS is one of the big killer features for postgrest which makes it so great for rapid prototyping something that's actually useful when exposed to the open internet.