An RLS role works for a workspace Viewer but an Admin can see all regions. What explains the difference?

1. Sensitivity labels automatically remove RLS
2. RLS always fails after publication
3. Admin users are automatically assigned every RegionID
4. RLS does not restrict workspace Admins as ordinary viewers