Can I use row-level-security for application users?
Row security policies are general SQL expressions, so you are not required to use database users. However, the policy has to know what the current user is, and this is easier with current_user than with some other setting. (It would be possible to use current_setting('my_app.app_user'), but that requires you to SET this value in every connection, and is not protected against changes made by injected SQL code.)