-- Allow tenant-scoped delete on creatives (clients); agency uses service role.
alter table public.creatives enable row level security;

drop policy if exists creatives_tenant_delete on public.creatives;
create policy creatives_tenant_delete on public.creatives
  for delete using (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );