Mira's right. Here's how to answer your HR person with evidence instead of a guess. Run this in the SQL editor:
It's not just pick_events. With RLS off, the anon key (which every browser that opens the dashboard has) can select, insert, update and delete in all three tables. So yes, anyone can read it, and anyone can also change the pick rates.
Fix, in this order. Create a managers table with the user ids of your floor managers, then:
alter table pick_events enable row level security;
alter table shifts enable row level security;
alter table employees enable row level security;
create policy "managers read" on pick_events for select
using (exists (select 1 from managers m where m.user_id = auth.uid()));Same select policy for shifts and employees. Then rerun the query above until it returns nothing. Since employees probably holds names, tell HR honestly that it was readable, and since when.
Three tables, not one. RLS is on for all three and the query returns nothing now. The dashboard is blank though. 
tomvibes
tomvibes Blank is the policy doing its job. Add the managers to the managers table and log in as one of them. jb_supa
Added our four floor managers, numbers are back. Going to talk to HR now. tomvibes
tomvibes
pick_eventshas RLS on. Table Editor shows it next to the table name. mira_dev