Enable RLS
Row-level security filters rows per role. It does nothing until you enable it on the table, and then it denies everything without a policy. A setting such as app.country carries the caller's identity.
task
A rep sees only customers of the country in setting app.country. Enable RLS, add the policy, set app.country to DE, SET ROLE rep and count the visible customers.