# Realtime 403: authorization failed, not a channel typo

A channel that 403s on subscribe (or subscribes but delivers nothing) is failing authorization. Agents rename the channel, add prefixes, and retry. The name was never the mechanism.

## Symptom to cause to confirmation to fix

1. Read the actual error. 403 on subscribe is an authorization rejection. Fix the policy, not the channel name.
2. Check the subscriber has a SELECT policy covering the rows the channel would deliver. Realtime checks the policy per subscriber per event; no matching policy means no access.
3. For channels scoped to a conversation, room, or tenant, encode the scope in the data and the policy (`room_id` in the membership table), not in the channel topic string. Anyone can subscribe to any topic name they guess.
4. Confirm the JWT is attached to the realtime client. A realtime connection without the user's token authorizes as anon, and anon policies rarely grant access to private data.
5. Test the policy with a plain REST query as the same user first. If the REST query returns nothing, the realtime channel will too. Fix the policy once, in one place.

## Verification

Subscribe as an authorized user and confirm events flow. Subscribe as an unauthorized user (or anon) and confirm 403 or silence. Both outcomes prove the policy is doing the gating, not the channel name.