diff --git a/alembic/versions/0129_rls_for_missing_tables.py b/alembic/versions/0129_rls_for_missing_tables.py
new file mode 100644
index 0000000..71c1ab4
--- /dev/null
+++ b/alembic/versions/0129_rls_for_missing_tables.py
@@ -0,0 +1,42 @@
+"""Enable RLS for 8 tables that need tenant isolation.
+
+Tables excluded (no tenant_id column):
+- outbox_deliveries: linked via event_outbox which has tenant_id
+- marketplace_listings: global plugin marketplace, not tenant-specific
+
+Revision ID: 0129
+Revises: 0128
+"""
+
+from alembic import op
+
+revision = "0129"
+down_revision = "0128"
+branch_labels = None
+depends_on = None
+
+TABLES_NEEDING_RLS = [
+    "ai_decision_records",
+    "approval_requests",
+    "automation_agent_run_steps",
+    "roles",
+    "sequences",
+    "wiki_articles",
+    "wiki_article_versions",
+    "wiki_categories",
+]
+
+
+def upgrade() -> None:
+    for table in TABLES_NEEDING_RLS:
+        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;")
+        op.execute(
+            f"CREATE POLICY tenant_isolation ON {table} "
+            f"FOR ALL USING (tenant_id = current_setting('app.tenant_id')::uuid);"
+        )
+
+
+def downgrade() -> None:
+    for table in TABLES_NEEDING_RLS:
+        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
+        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;")