{"-- Update RLS policies for security_zones to allow users to create zones
DROP POLICY IF EXISTS \"Admins and managers can manage security zones\" ON public.security_zones","-- Create separate policies for different operations
CREATE POLICY \"Users can create security zones in their organization\" 
ON public.security_zones 
FOR INSERT 
WITH CHECK (
  EXISTS (
    SELECT 1 FROM user_roles ur 
    JOIN branches b ON ur.organization_id = b.organization_id
    WHERE ur.user_id = auth.uid() 
    AND b.id = security_zones.branch_id
  )
)","CREATE POLICY \"Admins and managers can update security zones\" 
ON public.security_zones 
FOR UPDATE 
USING (
  EXISTS (
    SELECT 1 FROM user_roles ur 
    JOIN branches b ON ur.organization_id = b.organization_id
    WHERE ur.user_id = auth.uid() 
    AND b.id = security_zones.branch_id
    AND ur.role IN ('admin', 'manager')
  )
)","CREATE POLICY \"Admins and managers can delete security zones\" 
ON public.security_zones 
FOR DELETE 
USING (
  EXISTS (
    SELECT 1 FROM user_roles ur 
    JOIN branches b ON ur.organization_id = b.organization_id
    WHERE ur.user_id = auth.uid() 
    AND b.id = security_zones.branch_id
    AND ur.role IN ('admin', 'manager')
  )
)"}