-- Tighten capa_update_owner RLS policy: remove department clause so only the
-- assigned owner can UPDATE their own CAPA row directly. Route-level auth
-- enforces field-level restrictions; this ensures DB-level enforcement matches.
DROP POLICY IF EXISTS "capa_update_owner" ON capa_actions;
CREATE POLICY "capa_update_owner" ON capa_actions FOR UPDATE
  USING (owner_user_id = auth.uid());