MFA Policy from documentation dont work

# Bug report - [x] I confirm this is a bug with Supabase, not with my own application. - [x] I confirm I have searched the [Docs](https://docs.supabase.com), GitHub [Discussions](https://github.com/supabase/supabase/discussions), and [Discord](https://discord.supabase.com). There is a closed issue about this bug but I was closed for inactivity https://github.com/supabase/supabase/issues/17168 and never went through. ## Describe the bug My application support MFA but it's not a requirement. User are free to opt-in by enrolling a device. User with an enrolled device must be in `AAL2` to access the DB. I've found in the documentation an RLS policy that should works for my use case: https://supabase.com/docs/guides/auth/auth-mfa#enforce-rules-for-mfa-logins in the `Enforce only for users that have opted-in` section. But this RLS policy try to SELECT devices from `auth.mfa_factors` however, users are not allowed to select rows from this table. So this RLS is crashing every request, even with supabase dashboard impersonation:  I can see that the network request to the DB returned a 400 error code with this error: ```json { "code":400, "message":"ERROR: 42501: permission denied for table mfa_factors\n", "requestId":"3d32a05b-5daa-4290-818e-13d7c3c6ff66" } ``` ## To Reproduce 1. I'm using a custom schema in case it matters, you can create an `app` schema too (this schema is exposed by the supabase API) ```sql CREATE SCHEMA IF NOT EXISTS "app"; ALTER SCHEMA "app" OWNER TO "postgres"; GRANT USAGE ON SCHEMA "app" TO "postgres"; GRANT USAGE ON SCHEMA "app" TO "authenticated"; GRANT USAGE ON SCHEMA "app" TO "service_role"; ``` 2. Create a table in the `app` schema 3. Setup the RLS from the documentation for the new app table ```sql create policy "MFA Policy" on app.table_name as restrictive to authenticated using ( array[(select auth.jwt()->>'aal')] <@ ( select …