Re: Delegating superuser tasks to new security roles (Was: Granting control of SUSET gucs to non-superusers)

[Mark Dilger]

> On Jul 26, 2021, at 1:12 PM, Robert Haas <robertmh...@gmail.com> wrote:
> 
> Alice should not be permitted to preventing Bob
> from doing something which Bob is allowed to do and Alice is not
> allowed to do.

That sounds intuitively reasonable, though it depends on what "which Bob is 
allowed to do" means.  For instance, if Alice is only allowed to enable or 
disable connections to the database, and she disables them, then she has 
prevented Bob from, for example, creating tables, something which Bob is 
otherwise allowed to do, because without the ability to connect, he cannot 
create tables.

—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company