User Verification for Operations after Login

I have a weird problem in my app that Appwrite does not see the authenticated user. After awaiting account.createEmailPasswordSession() and account.get() I want to use the returned userID to query a database document that only has row permissions for only this user. But I can only access the document when i give table permissions for all, which I do not want in this case.

I assume this is an issue on the flutter side and my handling, but other operations from my app work in a similar manner.

How does Appwrite verify where the request comes from and how can I use getRow() and listRows() correctly?

Here is a tiny snippet:

final session = await _account.createEmailPasswordSession(
  email: email,
  password: password,
);
final user = await _account.get();

final databaseId = dotenv.get('APPWRITE_DB_ID'); //debugPrint is correct
final userID = user.$id;         //debugPrint is correct

final userRows = await _tablesDB.listRows(
  databaseId: databaseId,
  tableId: 'user_keys',
); //this shows 0 rows if row permissions and 5 if table permissions