diff --git a/packages/database/supabase/migrations/20260605142437_public_resource_access.sql b/packages/database/supabase/migrations/20260605142437_public_resource_access.sql
new file mode 100644
index 000000000..4f4e2754f
--- /dev/null
+++ b/packages/database/supabase/migrations/20260605142437_public_resource_access.sql
@@ -0,0 +1,31 @@
+CREATE OR REPLACE FUNCTION public.my_user_accounts() RETURNS SETOF UUID
+STABLE SECURITY DEFINER
+SET search_path = ''
+LANGUAGE sql
+AS $$
+    SELECT auth.uid() WHERE auth.uid() IS NOT NULL UNION
+    SELECT '00000000-0000-0000-0000-000000000000'::uuid UNION
+    SELECT group_id FROM public.group_membership
+    WHERE member_id = auth.uid();
+$$;
+
+
+CREATE OR REPLACE FUNCTION public.can_access_account(account_uid UUID) RETURNS boolean
+STABLE SECURITY DEFINER
+SET search_path = ''
+LANGUAGE sql
+AS $$
+    SELECT account_uid = auth.uid() OR account_uid = '00000000-0000-0000-0000-000000000000'::uuid OR EXISTS (
+        SELECT 1 FROM public.group_membership
+        WHERE member_id = auth.uid() AND group_id=account_uid
+        LIMIT 1
+    );
+$$;
+
+GRANT SELECT ON TABLE public."ResourceAccess" TO anon;
+GRANT SELECT ON TABLE public."Document" TO anon;
+GRANT SELECT ON TABLE public."Content" TO anon;
+GRANT SELECT ON TABLE public."Concept" TO anon;
+
+INSERT INTO auth.users (instance_id, id, aud, role, created_at, updated_at, is_super_admin, is_anonymous)
+VALUES ('00000000-0000-0000-0000-000000000000', '00000000-0000-0000-0000-000000000000', 'anon', 'anon', now(), now(), false, true);
diff --git a/packages/database/supabase/schemas/account.sql b/packages/database/supabase/schemas/account.sql
index bc415f662..41b89a9b0 100644
--- a/packages/database/supabase/schemas/account.sql
+++ b/packages/database/supabase/schemas/account.sql
@@ -1,3 +1,7 @@
+-- Anonymous pseudo-user
+INSERT INTO auth.users (instance_id, id, aud, role, created_at, updated_at, is_super_admin, is_anonymous)
+VALUES ('00000000-0000-0000-0000-000000000000', '00000000-0000-0000-0000-000000000000', 'anon', 'anon', now(), now(), false, true);
+
 CREATE TYPE public."AgentType" AS ENUM (
     'person',
     'organization',
@@ -204,7 +208,7 @@ STABLE SECURITY DEFINER
 SET search_path = ''
 LANGUAGE sql
 AS $$
-    SELECT account_uid = auth.uid() OR EXISTS (
+    SELECT account_uid = auth.uid() OR account_uid = '00000000-0000-0000-0000-000000000000'::uuid OR EXISTS (
         SELECT 1 FROM public.group_membership
         WHERE member_id = auth.uid() AND group_id=account_uid
         LIMIT 1
@@ -219,6 +223,7 @@ SET search_path = ''
 LANGUAGE sql
 AS $$
     SELECT auth.uid() WHERE auth.uid() IS NOT NULL UNION
+    SELECT '00000000-0000-0000-0000-000000000000'::uuid UNION
     SELECT group_id FROM public.group_membership
     WHERE member_id = auth.uid();
 $$;
diff --git a/packages/database/supabase/schemas/concept.sql b/packages/database/supabase/schemas/concept.sql
index 7677dd40b..a3aea1a97 100644
--- a/packages/database/supabase/schemas/concept.sql
+++ b/packages/database/supabase/schemas/concept.sql
@@ -117,6 +117,7 @@ ADD CONSTRAINT "Concept_space_id_fkey" FOREIGN KEY (
 
 
 REVOKE ALL ON TABLE public."Concept" FROM anon;
+GRANT SELECT ON TABLE public."Concept" TO anon;
 GRANT ALL ON TABLE public."Concept" TO authenticated;
 GRANT ALL ON TABLE public."Concept" TO service_role;
 
diff --git a/packages/database/supabase/schemas/content.sql b/packages/database/supabase/schemas/content.sql
index b6f9cdbb7..966eeaee4 100644
--- a/packages/database/supabase/schemas/content.sql
+++ b/packages/database/supabase/schemas/content.sql
@@ -191,12 +191,15 @@ CREATE INDEX resource_access_content_local_id_idx ON public."ResourceAccess" (so
 GRANT ALL ON TABLE public."ResourceAccess" TO authenticated;
 GRANT ALL ON TABLE public."ResourceAccess" TO service_role;
 REVOKE ALL ON TABLE public."ResourceAccess" FROM anon;
+GRANT SELECT ON TABLE public."ResourceAccess" TO anon;
 
 REVOKE ALL ON TABLE public."Document" FROM anon;
+GRANT SELECT ON TABLE public."Document" TO anon;
 GRANT ALL ON TABLE public."Document" TO authenticated;
 GRANT ALL ON TABLE public."Document" TO service_role;
 
 REVOKE ALL ON TABLE public."Content" FROM anon;
+GRANT SELECT ON TABLE public."Content" TO anon;
 GRANT ALL ON TABLE public."Content" TO authenticated;
 GRANT ALL ON TABLE public."Content" TO service_role;