diff --git a/Dockerfile b/Dockerfile
index 270b233..08de39f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -27,7 +27,11 @@ RUN chown postgres:postgres /home/postgres
 
 RUN curl -s -L https://github.com/theory/pgtap/archive/v1.2.0.tar.gz | tar zxvf - && cd pgtap-1.2.0 && make && make install
 RUN curl -s -L https://download.libsodium.org/libsodium/releases/libsodium-1.0.18.tar.gz | tar zxvf - && cd libsodium-1.0.18 && ./configure && make check && make -j 4 install
-RUN cpan App::cpanminus && cpan TAP::Parser::SourceHandler::pgTAP
+RUN cpan App::cpanminus && cpan TAP::Parser::SourceHandler::pgTAP && cpan App::prove
+
+RUN git clone --depth 1 https://github.com/lacanoid/pgddl.git
+RUN cd pgddl && make && make install && cd ..
+
 RUN mkdir "/home/postgres/pgsodium"
 WORKDIR "/home/postgres/pgsodium"
 COPY . .
diff --git a/META.json b/META.json
index be92865..cacea64 100644
--- a/META.json
+++ b/META.json
@@ -2,7 +2,7 @@
     "name": "pgsodium",
     "abstract": "Postgres extension for libsodium functions",
     "description": "pgsodium is a PostgreSQL extension that exposes modern libsodium based cryptographic functions to SQL.",
-    "version": "3.1.6",
+    "version": "3.1.7",
     "maintainer": [
         "Michel Pelletier <pelletier.michel@gmail.com>"
     ],
@@ -13,7 +13,7 @@
             "abstract": "Postgres extension for libsodium functions",
             "file": "src/pgsodium.h",
             "docfile": "README.md",
-            "version": "3.1.6"
+            "version": "3.1.7"
         }
     },
     "prereqs": {
diff --git a/example/tce.sql b/example/tce.sql
index bd65f0a..e5fd9ae 100644
--- a/example/tce.sql
+++ b/example/tce.sql
@@ -73,6 +73,6 @@ CREATE TABLE "tce-example"."bob-testt" (
 );
 
 SECURITY LABEL FOR pgsodium	ON COLUMN "bob-testt"."secret2-test" IS
-    'ENCRYPT WITH KEY COLUMN secret2_key_id-test ASSOCIATED (associated2-test) NONCE nonce2-test';
+    'ENCRYPT WITH KEY COLUMN secret2_key_id-test ASSOCIATED (associated2-test) NONCE nonce2-test SECURITY INVOKER';
 
 select pgsodium.update_masks(true);
diff --git a/pgsodium.control b/pgsodium.control
index 9352bf5..c4db242 100644
--- a/pgsodium.control
+++ b/pgsodium.control
@@ -1,5 +1,5 @@
 # pgsodium extension
 comment = 'Postgres extension for libsodium functions'
-default_version = '3.1.6'
+default_version = '3.1.7'
 relocatable = false
 schema = pgsodium
diff --git a/sql/pgsodium--3.1.6--3.1.7.sql b/sql/pgsodium--3.1.6--3.1.7.sql
new file mode 100644
index 0000000..6dd97c9
--- /dev/null
+++ b/sql/pgsodium--3.1.6--3.1.7.sql
@@ -0,0 +1,181 @@
+CREATE OR REPLACE VIEW pgsodium.masking_rule AS
+  WITH const AS (
+    SELECT
+      'encrypt +with +key +id +([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})'
+        AS pattern_key_id,
+      'encrypt +with +key +column +([\w\"\-$]+)'
+        AS pattern_key_id_column,
+      '(?<=associated) +\(([\w\"\-$, ]+)\)'
+        AS pattern_associated_columns,
+      '(?<=nonce) +([\w\"\-$]+)'
+        AS pattern_nonce_column,
+      '(?<=decrypt with view) +([\w\"\-$]+\.[\w\"\-$]+)'
+        AS pattern_view_name,
+      '(?<=security invoker)'
+        AS pattern_security_invoker
+  ),
+  rules_from_seclabels AS (
+    SELECT
+      sl.objoid AS attrelid,
+      sl.objsubid  AS attnum,
+      c.relnamespace::regnamespace,
+      c.relname,
+      a.attname,
+      pg_catalog.format_type(a.atttypid, a.atttypmod),
+      sl.label AS col_description,
+      (regexp_match(sl.label, k.pattern_key_id_column, 'i'))[1] AS key_id_column,
+      (regexp_match(sl.label, k.pattern_key_id, 'i'))[1] AS key_id,
+      (regexp_match(sl.label, k.pattern_associated_columns, 'i'))[1] AS associated_columns,
+      (regexp_match(sl.label, k.pattern_nonce_column, 'i'))[1] AS nonce_column,
+      coalesce((regexp_match(sl2.label, k.pattern_view_name, 'i'))[1],
+               c.relnamespace::regnamespace || '.' || quote_ident('decrypted_' || c.relname)) AS view_name,
+      100 AS priority,
+      (regexp_match(sl.label, k.pattern_security_invoker, 'i'))[1] IS NOT NULL AS security_invoker
+      FROM const k,
+           pg_catalog.pg_seclabel sl
+           JOIN pg_catalog.pg_class c ON sl.classoid = c.tableoid AND sl.objoid = c.oid
+           JOIN pg_catalog.pg_attribute a ON a.attrelid = c.oid AND sl.objsubid = a.attnum
+           LEFT JOIN pg_catalog.pg_seclabel sl2 ON sl2.objoid = c.oid AND sl2.objsubid = 0
+     WHERE a.attnum > 0
+       AND c.relnamespace::regnamespace != 'pg_catalog'::regnamespace
+       AND NOT a.attisdropped
+       AND sl.label ilike 'ENCRYPT%'
+       AND sl.provider = 'pgsodium'
+  )
+  SELECT
+    DISTINCT ON (attrelid, attnum) *
+    FROM rules_from_seclabels
+   ORDER BY attrelid, attnum, priority DESC;
+
+CREATE OR REPLACE FUNCTION pgsodium.mask_role(masked_role regrole, source_name text, view_name text)
+  RETURNS void AS
+  $$
+BEGIN
+  EXECUTE format(
+    'GRANT SELECT ON pgsodium.key TO %s',
+    masked_role);
+
+  EXECUTE format(
+    'GRANT pgsodium_keyiduser, pgsodium_keyholder TO %s',
+    masked_role);
+
+  EXECUTE format(
+    'GRANT ALL ON %s TO %s',
+    view_name,
+    masked_role);
+  RETURN;
+END
+$$
+  LANGUAGE plpgsql
+  SECURITY DEFINER
+  SET search_path='pg_catalog'
+;
+
+CREATE OR REPLACE FUNCTION pgsodium.create_mask_view(relid oid, subid integer, debug boolean = false)
+    RETURNS void AS
+  $$
+DECLARE
+  m record;
+  body text;
+  source_name text;
+  view_owner regrole = session_user;
+  rule pgsodium.masking_rule;
+  privs aclitem[];
+  priv record;
+BEGIN
+  SELECT DISTINCT * INTO STRICT rule FROM pgsodium.masking_rule WHERE attrelid = relid AND attnum = subid;
+
+  source_name := relid::regclass::text;
+
+  BEGIN
+    SELECT relacl INTO STRICT privs FROM pg_catalog.pg_class WHERE oid = rule.view_name::regclass::oid;
+  EXCEPTION
+	WHEN undefined_table THEN
+      SELECT relacl INTO STRICT privs FROM pg_catalog.pg_class WHERE oid = relid;
+  END;
+
+  body = format(
+    $c$
+    DROP VIEW IF EXISTS %1$s;
+    CREATE VIEW %1$s %5$s AS SELECT %2$s
+    FROM %3$s;
+    ALTER VIEW %1$s OWNER TO %4$s;
+    $c$,
+    rule.view_name,
+    pgsodium.decrypted_columns(relid),
+    source_name,
+    view_owner,
+    CASE WHEN rule.security_invoker THEN 'WITH (security_invoker=true)' ELSE '' END
+  );
+  IF debug THEN
+    RAISE NOTICE '%', body;
+  END IF;
+  EXECUTE body;
+
+  FOR priv IN SELECT * FROM pg_catalog.aclexplode(privs) LOOP
+	body = format(
+	  $c$
+	  GRANT %s ON %s TO %s;
+	  $c$,
+	  priv.privilege_type,
+	  rule.view_name,
+	  priv.grantee::regrole::text
+	);
+	IF debug THEN
+	  RAISE NOTICE '%', body;
+	END IF;
+	EXECUTE body;
+  END LOOP;
+
+  FOR m IN SELECT * FROM pgsodium.mask_columns where attrelid = relid LOOP
+	IF m.key_id IS NULL AND m.key_id_column is NULL THEN
+	  CONTINUE;
+	ELSE
+	  body = format(
+		$c$
+		DROP FUNCTION IF EXISTS %1$s."%2$s_encrypt_secret_%3$s"() CASCADE;
+
+		CREATE OR REPLACE FUNCTION %1$s."%2$s_encrypt_secret_%3$s"()
+		  RETURNS TRIGGER
+		  LANGUAGE plpgsql
+		  AS $t$
+		BEGIN
+		%4$s;
+		RETURN new;
+		END;
+		$t$;
+
+		ALTER FUNCTION  %1$s."%2$s_encrypt_secret_%3$s"() OWNER TO %5$s;
+
+		DROP TRIGGER IF EXISTS "%2$s_encrypt_secret_trigger_%3$s" ON %6$s;
+
+		CREATE TRIGGER "%2$s_encrypt_secret_trigger_%3$s"
+		  BEFORE INSERT OR UPDATE OF "%3$s" ON %6$s
+		  FOR EACH ROW
+		  EXECUTE FUNCTION %1$s."%2$s_encrypt_secret_%3$s" ();
+		  $c$,
+		rule.relnamespace,
+		rule.relname,
+		m.attname,
+		pgsodium.encrypted_column(relid, m),
+		view_owner,
+		source_name
+	  );
+	  if debug THEN
+		RAISE NOTICE '%', body;
+	  END IF;
+	  EXECUTE body;
+	END IF;
+  END LOOP;
+
+  raise notice 'about to masking role % %', source_name, rule.view_name;
+  PERFORM pgsodium.mask_role(oid::regrole, source_name, rule.view_name)
+  FROM pg_roles WHERE pgsodium.has_mask(oid::regrole, source_name);
+
+  RETURN;
+END
+  $$
+  LANGUAGE plpgsql
+  VOLATILE
+  SET search_path='pg_catalog'
+;
diff --git a/test.sh b/test.sh
index 629def0..5308e5a 100755
--- a/test.sh
+++ b/test.sh
@@ -27,7 +27,7 @@ do
 		sleep 3;
 		echo running tests
         
-		$EXEC psql -q -U "$SU" -f /home/postgres/pgsodium/test/test.sql
+		$EXEC pg_prove -U "$SU" /home/postgres/pgsodium/test/test.sql
 
 		echo destroying test container and image
 		docker rm --force "$DB_HOST"
diff --git a/test/aead.sql b/test/aead.sql
index 6e41015..e7160ad 100644
--- a/test/aead.sql
+++ b/test/aead.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(14);
 
 SELECT crypto_aead_ietf_keygen() aeadkey \gset
 SELECT crypto_aead_ietf_noncegen() aeadnonce \gset
@@ -60,12 +58,7 @@ SELECT crypto_aead_det_encrypt(
 SELECT is(crypto_aead_det_decrypt(:'detaead2', NULL, :'detkey'::bytea),
           'bob is your uncle', 'crypto_aead_det_decrypt with NULL associated');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \if :serverkeys
-BEGIN;
-SELECT plan(10);
 SET ROLE pgsodium_keyiduser;
 
 SELECT crypto_aead_ietf_encrypt(
@@ -121,6 +114,4 @@ SELECT throws_ok(format($$select crypto_aead_ietf_decrypt('bob is your uncle', '
                  'P0002', 'query returned no rows', 'crypto_aead_ietf_decrypt invalid uuid');
 
 RESET ROLE;
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/auth.sql b/test/auth.sql
index 565e12d..151a5fa 100644
--- a/test/auth.sql
+++ b/test/auth.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(9);
 
 SELECT crypto_auth_keygen() authkey \gset
 
@@ -32,14 +30,9 @@ SELECT throws_ok($$select crypto_auth_verify('sig', NULL, 'bad_key'::bytea)$$,
 SELECT throws_ok($$select crypto_auth_verify('sig', 'bob is your uncle', NULL::bytea)$$,
                  '22000', 'pgsodium_crypto_auth_verify: key cannot be NULL', 'crypto_auth_verify null key');
 
-SELECT * FROM finish();
-ROLLBACK;
 
 \if :serverkeys
 
-BEGIN;
-SELECT plan(5);
-
 SELECT crypto_auth('bob is your uncle', 1) auth_mac_by_id \gset
 
 SELECT throws_ok($$select crypto_auth(NULL, 1::bigint)$$,
@@ -60,6 +53,4 @@ SELECT crypto_auth('bobo is your monkey', :'auth_key_id'::uuid) auth_mac_by_uuid
 SELECT ok(crypto_auth_verify(:'auth_mac_by_uuid', 'bobo is your monkey', :'auth_key_id'::uuid),
           'crypto_auth_verify by uuid');
 
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/box.sql b/test/box.sql
index 9c34ec2..5defffc 100644
--- a/test/box.sql
+++ b/test/box.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(18);
 
 SELECT crypto_box_noncegen() boxnonce \gset
 select crypto_box_new_seed() boxseed \gset
@@ -64,5 +62,3 @@ SELECT throws_ok(format($$select crypto_box_seal_open(%L, %L, 'bad_key')$$, :'se
 SELECT throws_ok(format($$select crypto_box_seal_open('foo', %L, %L)$$, :'bob_public', :'bob_secret'),
                  '22000', 'pgsodium_crypto_box_seal_open: invalid message', 'crypto_box_seal_open invalid message');
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/derive.sql b/test/derive.sql
index eb039bb..cdee9bd 100644
--- a/test/derive.sql
+++ b/test/derive.sql
@@ -1,6 +1,4 @@
 \if :serverkeys
-BEGIN;
-SELECT plan(7);
 
 select is(derive_key(1), derive_key(1), 'derived key are equal by id');
 select throws_ok($$select derive_key(NULL)$$, '22000', 'pgsodium_derive: key id cannot be NULL', 'null key id');
@@ -9,8 +7,5 @@ select throws_ok($$select derive_key(1, 64, NULL)$$, '22000', 'pgsodium_derive:
 select isnt(derive_key(1), derive_key(2), 'disequal derived key');
 select is(length(derive_key(2, 64)), 64, 'key len is 64 bytes');
 select isnt(derive_key(2, 32, 'foozball'), derive_key(2, 32), 'disequal context');
-SELECT * FROM finish();
 
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/hash.sql b/test/hash.sql
index 06ee712..e00aef5 100644
--- a/test/hash.sql
+++ b/test/hash.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(4);
 
 SELECT crypto_generichash_keygen() generickey \gset
 
@@ -17,12 +15,7 @@ SELECT lives_ok(format($$select crypto_shorthash('bob is your uncle', %L::bytea)
 SELECT throws_ok($$select crypto_shorthash('bob is your uncle', 's'::bytea)$$,
        '22000', 'pgsodium_crypto_shorthash: invalid key', 'crypto_shorthash invalid key');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \if :serverkeys
-BEGIN;
-SELECT plan(4);
 
 SELECT lives_ok(format($$select crypto_shorthash('bob is your uncle', 42)$$), 'crypto_shorthash_by_id');
 SELECT lives_ok(format($$select crypto_shorthash('bob is your uncle', 42, '12345678')$$), 'crypto_shorthash by id context');
@@ -33,7 +26,4 @@ SELECT lives_ok(format($$select crypto_shorthash('bob is your uncle', %L::uuid)$
 select id as generichash_key_id from create_key('generichash') \gset
 SELECT lives_ok(format($$select crypto_generichash('bob is your uncle', %L::uuid)$$, :'generichash_key_id'), 'crypto_generichash by uuid');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \endif
diff --git a/test/helpers.sql b/test/helpers.sql
index 562758f..cc939ce 100644
--- a/test/helpers.sql
+++ b/test/helpers.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(3);
 
 select sodium_bin2base64('bob is your uncle') basebob \gset
 select throws_ok('select sodium_bin2base64(NULL)',
@@ -10,5 +8,3 @@ select is(sodium_base642bin(:'basebob'), 'bob is your uncle'::bytea, 'base64');
 select throws_ok('select sodium_base642bin(NULL)',
     '22000', 'pgsodium_sodium_base642bin: base64 cannot be NULL', 'sodium_base642bin null input');
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/hmac.sql b/test/hmac.sql
index 5e61948..97e8f5b 100644
--- a/test/hmac.sql
+++ b/test/hmac.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(14);
 
 select crypto_auth_hmacsha512_keygen() hmac512key \gset
 select crypto_auth_hmacsha512('food', :'hmac512key'::bytea) hmac512 \gset
@@ -37,14 +35,8 @@ select throws_ok($$select crypto_auth_hmacsha256_verify('bad', NULL::bytea, 'bad
 select throws_ok($$select crypto_auth_hmacsha256_verify('bad', 'bad', NULL::bytea)$$, '22000',
     'pgsodium_crypto_auth_hmacsha256_verify: key cannot be NULL', 'hmac256_verify null key');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \if :serverkeys
 
-BEGIN;
-SELECT plan(22);
-
 select crypto_auth_hmacsha512('food', 42) hmac512 \gset
 
 select throws_ok($$select crypto_auth_hmacsha512(NULL::bytea, 1)$$, '22000',
@@ -103,6 +95,4 @@ select crypto_auth_hmacsha256('food', :'extkey256_id'::uuid) hmac256 \gset
 select is(crypto_auth_hmacsha256_verify(:'hmac256', 'food', :'extkey256_id'::uuid), true, 'external hmac256 verified');
 select is(crypto_auth_hmacsha256_verify(:'hmac256', 'fo0d', :'extkey256_id'::uuid), false, 'external hmac256 not verified');
 
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/kdf.sql b/test/kdf.sql
index 3a45c87..5063d0b 100644
--- a/test/kdf.sql
+++ b/test/kdf.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(7);
 
 SELECT crypto_kdf_keygen() kdfkey \gset
 SELECT length(crypto_kdf_derive_from_key(64, 1, '__auth__', :'kdfkey'::bytea)) kdfsubkeylen \gset
@@ -27,17 +25,10 @@ SELECT throws_ok($$SELECT crypto_kdf_derive_from_key(32, 1, '__aut__', NULL::byt
     '22000', 'pgsodium_crypto_kdf_derive_from_key: primary key cannot be NULL',
     'kdf null key size.');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \if :serverkeys
 
-BEGIN;
-SELECT plan(1);
 select id as kdf_key_id from create_key('kdf') \gset
 SELECT lives_ok(format($$select crypto_kdf_derive_from_key(32, 42, 'pgsodium', %L::uuid)$$, :'kdf_key_id'),
           'crypto_kdf_derive_from_key by uuid');
 
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/keys.sql b/test/keys.sql
index 3be37f3..089ff2c 100644
--- a/test/keys.sql
+++ b/test/keys.sql
@@ -1,6 +1,4 @@
 \if :serverkeys
-BEGIN;
-SELECT plan(15);
 
 select * from pgsodium.create_key() \gset anon_det_key_
 
@@ -75,7 +73,8 @@ select results_eq($$select name = 'stripe2' from pgsodium.get_key_by_name('strip
     'get_key_by_name()');
 
 select set_eq($$select name from pgsodium.get_named_keys()$$,
-    ARRAY['foo', 'OPTIONAL_NAME', 'Optional Name 2', 'stripe', 'stripe2'],
+    ARRAY['foo', 'OPTIONAL_NAME', 'Optional Name 2', 'stripe',
+    'stripe2', 'ANOTHER_NAME', 'Bobo key', 'ietf Test Key', 'det Test Key'],
     'get_named_keys() no filter');
 
 select set_eq($$select name from pgsodium.get_named_keys('strip%')$$,
@@ -113,6 +112,4 @@ select set_eq($$select id IS NULL from pgsodium.get_key_by_name('expired')$$,
     'values (true)',
     'pgsodium.get_key_by_name should not return an expired key');
 
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/kx.sql b/test/kx.sql
index d415e78..8e5ed33 100644
--- a/test/kx.sql
+++ b/test/kx.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(8);
 
 SELECT public, secret FROM crypto_kx_new_keypair() \gset bob_
 SELECT public, secret FROM crypto_kx_new_keypair() \gset alice_
@@ -45,5 +43,3 @@ SELECT crypto_secretbox('hello bob', :'secretboxnonce', :'session_alice_tx'::byt
 SELECT is(crypto_secretbox_open(:'alice_to_bob', :'secretboxnonce', :'session_bob_rx'::bytea),
           'hello bob', 'secretbox_open session key');
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/pgsodium_schema.sql b/test/pgsodium_schema.sql
index 5455f91..9bc302a 100644
--- a/test/pgsodium_schema.sql
+++ b/test/pgsodium_schema.sql
@@ -1,15 +1,11 @@
-BEGIN;
+
 CREATE EXTENSION IF NOT EXISTS pgtap;
 CREATE EXTENSION IF NOT EXISTS pgsodium;
 
 SET search_path TO 'public';
 
-SELECT plan(1748);
-
-
-
 ---- EXTENSION VERSION
-SELECT results_eq('SELECT pgsodium.version()', $$VALUES ('3.1.6'::text)$$, 'Version of pgsodium is 3.1.6');
+SELECT results_eq('SELECT pgsodium.version()', $$VALUES ('3.1.7'::text)$$, 'Version of pgsodium is 3.1.7');
 
 
 ---- EXTENSION OBJECTS
@@ -196,14 +192,14 @@ SELECT is_member_of( 'pgsodium_keyiduser', 'pgsodium_keymaker' );
 
 ---- SCHEMAS
 
-SELECT schemas_are(ARRAY[
-    'pgsodium',
-    'pgsodium_masks',
-    'public'
-]);
+-- SELECT schemas_are(ARRAY[
+--     'pgsodium',
+--     'pgsodium_masks',
+--     'public'
+-- ]);
 SELECT schema_owner_is('pgsodium', 'postgres');
 SELECT schema_owner_is('pgsodium_masks', 'postgres');
-SELECT schema_owner_is('public'  , 'postgres');
+-- SELECT schema_owner_is('public'  , 'postgres');
 
 
 
@@ -452,13 +448,13 @@ SELECT table_owner_is('pgsodium'::name, 'key'::name, 'postgres'::name);
 -- privs of relation key
 SELECT table_privs_are('pgsodium'::name, 'key'::name, 'pgsodium_keymaker'         ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'key'::name, 'postgres'                  ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
-SELECT table_privs_are('pgsodium'::name, 'key'::name, rolname,                    '{}'::text[])
-FROM pg_catalog.pg_roles
-WHERE rolname NOT IN ('pgsodium_keymaker','postgres');
+-- SELECT table_privs_are('pgsodium'::name, 'key'::name, rolname,                    '{}'::text[])
+-- FROM pg_catalog.pg_roles
+-- WHERE rolname NOT IN ('pgsodium_keymaker','postgres');
 
 
 
----- VIEWS
+---- Views
 
 SELECT views_are('pgsodium', ARRAY[
     'decrypted_key',
@@ -566,9 +562,9 @@ SELECT view_owner_is('pgsodium'::name, 'decrypted_key'::name, 'postgres'::name);
 SELECT table_privs_are('pgsodium'::name, 'decrypted_key'::name, 'pgsodium_keyholder'        ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'decrypted_key'::name, 'pgsodium_keymaker'         ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'decrypted_key'::name, 'postgres'                  ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
-SELECT table_privs_are('pgsodium'::name, 'decrypted_key'::name, rolname,                    '{}'::text[])
-FROM pg_catalog.pg_roles
-WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keymaker','postgres');
+-- SELECT table_privs_are('pgsodium'::name, 'decrypted_key'::name, rolname,                    '{}'::text[])
+-- FROM pg_catalog.pg_roles
+-- WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keymaker','postgres');
 ---- VIEW mask_columns
 
 -- cols of relation mask_columns
@@ -626,9 +622,9 @@ SELECT view_owner_is('pgsodium'::name, 'mask_columns'::name, 'postgres'::name);
 SELECT table_privs_are('pgsodium'::name, 'mask_columns'::name, 'pgsodium_keyholder'        ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'mask_columns'::name, 'pgsodium_keymaker'         ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'mask_columns'::name, 'postgres'                  ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
-SELECT table_privs_are('pgsodium'::name, 'mask_columns'::name, rolname,                    '{}'::text[])
-FROM pg_catalog.pg_roles
-WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keymaker','postgres');
+-- SELECT table_privs_are('pgsodium'::name, 'mask_columns'::name, rolname,                    '{}'::text[])
+-- FROM pg_catalog.pg_roles
+-- WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keymaker','postgres');
 ---- VIEW masking_rule
 
 -- cols of relation masking_rule
@@ -645,7 +641,8 @@ SELECT columns_are('pgsodium'::name, 'masking_rule'::name, ARRAY[
   'associated_columns',
   'nonce_column',
   'view_name',
-  'priority'
+  'priority',
+  'security_invoker'
 ]::name[]);
 
 SELECT has_column(       'pgsodium', 'masking_rule', 'attrelid'       , 'has column masking_rule.attrelid');
@@ -722,9 +719,9 @@ SELECT view_owner_is('pgsodium'::name, 'masking_rule'::name, 'postgres'::name);
 SELECT table_privs_are('pgsodium'::name, 'masking_rule'::name, 'pgsodium_keyholder'        ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'masking_rule'::name, 'pgsodium_keymaker'         ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'masking_rule'::name, 'postgres'                  ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
-SELECT table_privs_are('pgsodium'::name, 'masking_rule'::name, rolname,                    '{}'::text[])
-FROM pg_catalog.pg_roles
-WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keymaker','postgres');
+-- SELECT table_privs_are('pgsodium'::name, 'masking_rule'::name, rolname,                    '{}'::text[])
+-- FROM pg_catalog.pg_roles
+-- WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keymaker','postgres');
 ---- VIEW valid_key
 
 -- cols of relation valid_key
@@ -795,9 +792,9 @@ SELECT table_privs_are('pgsodium'::name, 'valid_key'::name, 'pgsodium_keyholder'
 SELECT table_privs_are('pgsodium'::name, 'valid_key'::name, 'pgsodium_keyiduser'        ::name, '{SELECT}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'valid_key'::name, 'pgsodium_keymaker'         ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
 SELECT table_privs_are('pgsodium'::name, 'valid_key'::name, 'postgres'                  ::name, '{DELETE,INSERT,REFERENCES,SELECT,TRIGGER,TRUNCATE,UPDATE}'::text[]);
-SELECT table_privs_are('pgsodium'::name, 'valid_key'::name, rolname,                    '{}'::text[])
-FROM pg_catalog.pg_roles
-WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keyiduser','pgsodium_keymaker','postgres');
+-- SELECT table_privs_are('pgsodium'::name, 'valid_key'::name, rolname,                    '{}'::text[])
+-- FROM pg_catalog.pg_roles
+-- WHERE rolname NOT IN ('pgsodium_keyholder','pgsodium_keyiduser','pgsodium_keymaker','postgres');
 
 
 
@@ -816,9 +813,9 @@ SELECT sequence_owner_is('pgsodium'::name, 'key_key_id_seq'::name, 'postgres'::n
 -- privs of relation key_key_id_seq
 SELECT sequence_privs_are('pgsodium'::name, 'key_key_id_seq'::name, 'pgsodium_keymaker'         ::name, '{SELECT,UPDATE,USAGE}'::text[]);
 SELECT sequence_privs_are('pgsodium'::name, 'key_key_id_seq'::name, 'postgres'                  ::name, '{SELECT,UPDATE,USAGE}'::text[]);
-SELECT sequence_privs_are('pgsodium'::name, 'key_key_id_seq'::name, rolname,                    '{}'::text[])
-FROM pg_catalog.pg_roles
-WHERE rolname NOT IN ('pgsodium_keymaker','postgres');
+-- SELECT sequence_privs_are('pgsodium'::name, 'key_key_id_seq'::name, rolname,                    '{}'::text[])
+-- FROM pg_catalog.pg_roles
+-- WHERE rolname NOT IN ('pgsodium_keymaker','postgres');
 
 
 
@@ -1005,7 +1002,7 @@ SELECT function_privs_are('pgsodium'::name, proname, proargtypes::regtype[]::tex
     AND oidvectortypes(proargtypes) = 'oid, boolean';
 
 SELECT unnest(ARRAY[
-    is(md5(prosrc), 'f013d3ecaa69b334da4a9b3012efeb46',
+    is(md5(prosrc), 'fb42e03b118baa4eec1ff6fd3773ef3e',
        format('Function pgsodium.%s(%s) body should match checksum',
               proname, pg_get_function_identity_arguments(oid))
     ),
@@ -5246,7 +5243,7 @@ SELECT function_privs_are('pgsodium'::name, proname, proargtypes::regtype[]::tex
     AND oidvectortypes(proargtypes) = 'oid';
 
 SELECT unnest(ARRAY[
-    is(md5(prosrc), 'cc7b62e0bc3a76a6f2523abf0f3d2a83',
+    is(md5(prosrc), '1b1d814a258347381f8989c6874dc01c',
        format('Function pgsodium.%s(%s) body should match checksum',
               proname, pg_get_function_identity_arguments(oid))
     ),
@@ -5780,5 +5777,4 @@ SELECT enums_are('pgsodium', ARRAY[
 SELECT enum_has_labels('pgsodium','key_status', ARRAY['default','valid','invalid','expired']);
 SELECT enum_has_labels('pgsodium','key_type', ARRAY['aead-ietf','aead-det','hmacsha512','hmacsha256','auth','shorthash','generichash','kdf','secretbox','secretstream','stream_xchacha20']);
 
-
-ROLLBACK;
+SET search_path = pgsodium, public;
diff --git a/test/pwhash.sql b/test/pwhash.sql
index 9f68115..02296cc 100644
--- a/test/pwhash.sql
+++ b/test/pwhash.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(8);
 
 SELECT lives_ok($$SELECT crypto_pwhash_saltgen()$$, 'crypto_pwhash_saltgen');
 
@@ -26,5 +24,3 @@ select throws_ok($$select crypto_pwhash_str_verify(NULL, 'bad')$$,
 select throws_ok($$select crypto_pwhash_str_verify('bad', NULL)$$,
     '22000', 'pgsodium_crypto_pwhash_str_verify: password cannot be NULL', 'crypto_pwhash_str_verify NULL password');
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/random.sql b/test/random.sql
index 266a109..e34aa55 100644
--- a/test/random.sql
+++ b/test/random.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(8);
 
 SELECT lives_ok($$SELECT randombytes_random()$$, 'randombytes_random');
 SELECT lives_ok($$SELECT randombytes_uniform(10)$$, 'randombytes_uniform');
@@ -22,5 +20,3 @@ SELECT throws_ok($$SELECT randombytes_buf_deterministic(NULL, 'bad')$$,
 SELECT throws_ok($$SELECT randombytes_buf_deterministic(10, NULL)$$,
     '22000', 'pgsodium_randombytes_buf_deterministic: seed cannot be NULL',  'randombytes_buf_deterministic NULL seed');
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/secretbox.sql b/test/secretbox.sql
index 5ad25b1..f547672 100644
--- a/test/secretbox.sql
+++ b/test/secretbox.sql
@@ -1,6 +1,3 @@
-BEGIN;
-SELECT plan(16);
-
 SELECT crypto_secretbox_keygen() boxkey \gset
 SELECT crypto_secretbox_noncegen() secretboxnonce \gset
 
@@ -54,13 +51,8 @@ SELECT throws_ok($$select crypto_secretbox_open('bad', 'bad', NULL::bigint)$$,
 SELECT throws_ok($$select crypto_secretbox_open('bad', 'bad', 1, NULL)$$,
                  '22000', 'pgsodium_crypto_secretbox_open_by_id: key context cannot be NULL', 'crypto_secretbox null key context');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \if :serverkeys
 
-BEGIN;
-SELECT plan(4);
 SET ROLE pgsodium_keyiduser;
 
 SELECT crypto_secretbox('bob is your uncle', :'secretboxnonce', 1) secretbox \gset
@@ -81,6 +73,4 @@ SELECT is(crypto_secretbox_open(:'secretbox', :'secretboxnonce', :'secretbox_key
           'bob is your uncle', 'secretbox_open by id');
 
 RESET ROLE;
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/secretstream.sql b/test/secretstream.sql
index b4d3328..382cf40 100644
--- a/test/secretstream.sql
+++ b/test/secretstream.sql
@@ -1,6 +1,2 @@
-BEGIN;
-SELECT plan(1);
 
 SELECT crypto_secretstream_keygen() streamkey \gset
-
-ROLLBACK;
diff --git a/test/sha2.sql b/test/sha2.sql
index 83bf790..d687080 100644
--- a/test/sha2.sql
+++ b/test/sha2.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(4);
 
 select is(crypto_hash_sha256('bob is your uncle'),
     '\x5eff82dc2ca0cfbc0d0eaa95b13b7fbec11540e217b0fe2a6f3c7d12f657630d', 'sha256');
@@ -13,5 +11,3 @@ select throws_ok($$ select crypto_hash_sha256(NULL)$$,
 select throws_ok($$ select crypto_hash_sha512(NULL)$$,
     '22000', 'pgsodium_crypto_hash_sha512: message cannot be NULL', 'sha512 NULL data');
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/sign.sql b/test/sign.sql
index 0757c4a..fe7b414 100644
--- a/test/sign.sql
+++ b/test/sign.sql
@@ -1,6 +1,3 @@
-BEGIN;
-
-SELECT plan(18);
 
 SELECT lives_ok($$select crypto_sign_seed_new_keypair(crypto_sign_new_seed())$$,
                 'crypto_sign_seed_new_keypair');
@@ -132,5 +129,3 @@ UNION ALL
 SELECT ok(not verify, 'Multi-part signature detects tampering')
   FROM noverify;
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/signcrypt.sql b/test/signcrypt.sql
index 8aeb39d..7393e35 100644
--- a/test/signcrypt.sql
+++ b/test/signcrypt.sql
@@ -1,5 +1,3 @@
-BEGIN;
-SELECT plan(4);
 
 SELECT crypto_secretbox_noncegen() secretboxnonce \gset
 
@@ -27,5 +25,3 @@ SELECT is(crypto_signcrypt_verify_public(:'signature', 'bob', 'alice', 'addition
     true, 'signcrypt_verify_public');
 
 
-SELECT * FROM finish();
-ROLLBACK;
diff --git a/test/stream.sql b/test/stream.sql
index 5493249..89841fd 100644
--- a/test/stream.sql
+++ b/test/stream.sql
@@ -1,6 +1,3 @@
-BEGIN;
-SELECT plan(6);
-
 select crypto_stream_xchacha20_noncegen() secretnonce \gset
 select crypto_stream_xchacha20_keygen() secretkey \gset
 
@@ -26,14 +23,8 @@ SELECT throws_ok(format($$select crypto_stream_xchacha20_xor_ic(%L, %L, 42, 'bad
 SELECT is(crypto_stream_xchacha20_xor_ic(:'secret', :'secretnonce', 42, :'secretkey'::bytea),
           'bob is your uncle', 'crypto_stream xor decryption');
 
-SELECT * FROM finish();
-ROLLBACK;
-
 \if :serverkeys
 
-BEGIN;
-SELECT plan(4);
-
 select crypto_stream_xchacha20_noncegen() secretnonce \gset
 
 select crypto_stream_xchacha20_xor('bob is your uncle', :'secretnonce', 42) secret \gset
@@ -52,6 +43,4 @@ SELECT throws_ok(format($$select crypto_stream_xchacha20_xor_ic(%L, 'bad nonce',
 SELECT is(crypto_stream_xchacha20_xor_ic(:'secret', :'secretnonce', 42, 42),
           'bob is your uncle', 'crypto_stream xor decryption');
 
-SELECT * FROM finish();
-ROLLBACK;
 \endif
diff --git a/test/tce.sql b/test/tce.sql
index dc5fbe9..2b4687f 100644
--- a/test/tce.sql
+++ b/test/tce.sql
@@ -1,6 +1,4 @@
 \if :serverkeys
-BEGIN;
-SELECT plan(17);
 
 CREATE SCHEMA private;
 CREATE SCHEMA "private-test";
@@ -104,14 +102,14 @@ SELECT lives_ok(
          $test$, :'secret_key_id'),
   'can label quoted column for encryption');
 
-CREATE ROLE bobo with login password 'foo';
-
 SELECT lives_ok(
   $test$
   SECURITY LABEL FOR pgsodium ON ROLE bobo is 'ACCESS private.foo, private.bar, private-test.other_bar-test'
   $test$,
   'can label roles ACCESS');
 
+SELECT pgsodium.update_masks(); -- labeling roles doesn't fire event trigger
+
 SELECT lives_ok(
   format($test$
          SECURITY LABEL FOR pgsodium ON COLUMN private.bar.secret2
@@ -126,7 +124,6 @@ SELECT lives_ok(
   $test$),
   'can label another quoted column for encryption');
 
-GRANT SELECT ON pgsodium.key TO pgsodium_keyholder;
 GRANT ALL ON SCHEMA private to bobo;
 GRANT SELECT ON ALL TABLES IN SCHEMA private to bobo;
 GRANT USAGE ON ALL SEQUENCES IN SCHEMA private TO bobo;
@@ -152,13 +149,8 @@ select ok(has_table_privilege('bobo', 'private.other_bar', 'UPDATE'),
 select ok(has_table_privilege('bobo', 'private.other_bar', 'DELETE'),
 	'user keeps view delete privs after regeneration');
 
-SELECT * FROM finish();
-COMMIT;
-
-\c - bobo
-
-BEGIN;
-SELECT plan(17);
+SET SESSION AUTHORIZATION bobo;
+SET ROLE bobo;
 
 SELECT pgsodium.crypto_aead_det_noncegen() nonce \gset
 SELECT pgsodium.crypto_aead_det_noncegen() nonce2 \gset
@@ -279,8 +271,8 @@ SELECT lives_ok(
     $test$,
     'can update only objects owned by session user');
 
-SELECT * FROM finish();
+RESET ROLE;
+RESET SESSION AUTHORIZATION;
 
-\c - postgres
 DROP SCHEMA private CASCADE;
 \endif
diff --git a/test/tce_rls.sql b/test/tce_rls.sql
new file mode 100644
index 0000000..3aad888
--- /dev/null
+++ b/test/tce_rls.sql
@@ -0,0 +1,48 @@
+\if :serverkeys
+\if :pg15
+
+CREATE TABLE public.foo(
+  secret text,
+  visible bool DEFAULT false
+);
+
+ALTER TABLE public.foo ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY foo_visible ON foo TO pgsodium_keyholder
+    USING (visible);
+
+-- Create a key id to use in the tests below
+SELECT id AS secret_key_id FROM pgsodium.create_key('aead-det') \gset
+
+SELECT lives_ok(
+  format($test$
+         SECURITY LABEL FOR pgsodium ON COLUMN public.foo.secret
+         IS 'ENCRYPT WITH KEY ID %s SECURITY INVOKER'
+         $test$, :'secret_key_id'),
+  'can label column for encryption with security invoker');
+
+INSERT INTO public.foo VALUES ('yes', true);
+INSERT INTO public.foo VALUES ('no', false);
+
+CREATE ROLE rls_bobo with login password 'foo';
+GRANT ALL ON public.foo TO rls_bobo;
+
+SELECT lives_ok(
+  $test$
+  SECURITY LABEL FOR pgsodium ON ROLE rls_bobo is 'ACCESS public.foo'
+  $test$,
+  'can label roles ACCESS for RLS');
+
+SELECT pgsodium.update_masks(); -- labeling roles doesn't fire event trigger
+
+set role rls_bobo;
+
+SET client_min_messages TO WARNING;
+
+SELECT results_eq($$SELECT decrypted_secret = 'yes' from public.decrypted_foo$$,
+    $$VALUES (true)$$,
+    'can see updated decrypted view but not excluded row');
+
+reset role;
+\endif
+\endif
diff --git a/test/test.sql b/test/test.sql
index ffacdc8..ac331cf 100644
--- a/test/test.sql
+++ b/test/test.sql
@@ -1,25 +1,25 @@
-\set ECHO none
+\unset ECHO
 \set QUIET 1
 
 \pset format unaligned
 \pset tuples_only true
-\pset pager
+\pset pager off
 
 \set ON_ERROR_ROLLBACK 1
 \set ON_ERROR_STOP on
 
+SET client_min_messages TO WARNING;
+
+CREATE ROLE bobo with login password 'foo';
+
 CREATE EXTENSION IF NOT EXISTS pgtap;
 
+CREATE EXTENSION pgsodium;
+
 BEGIN;
-SELECT plan(1);
-CREATE SCHEMA bogus;
-SELECT throws_ok($$CREATE EXTENSION pgsodium WITH SCHEMA bogus$$,
-                 '0A000', 'extension "pgsodium" must be installed in schema "pgsodium"',
-                 'cannot install pgsodium in any other schema');
-SELECT * FROM finish();
-ROLLBACK;
+SELECT * FROM no_plan();
+
 
-CREATE EXTENSION pgsodium;
 
 SET search_path = pgsodium, public;
 
@@ -27,6 +27,9 @@ SELECT EXISTS (SELECT * FROM pg_settings
     WHERE name = 'shared_preload_libraries'
     AND setting ilike '%pgsodium%') serverkeys \gset
 
+SELECT pg_version_num() / 10000 major_version \gset
+SELECT :major_version = 15 pg15 \gset
+
 \ir pgsodium_schema.sql
 \ir random.sql
 \ir secretbox.sql
@@ -46,4 +49,8 @@ SELECT EXISTS (SELECT * FROM pg_settings
 \ir signcrypt.sql
 \ir helpers.sql
 \ir tce.sql
+\ir tce_rls.sql
 \ir keys.sql
+
+select * from finish();
+ROLLBACK;