> Hah, role management for us is "create a role for migrations, and a role to do db things, and enforce auth entirely in the web app"

> I suspect we aren't alone

Honestly I'd be happy to spend the time learning the ins and outs of PostgreSQL IAM stuff, but there's two very good reasons why I won't use it:

1. Still need the "role"/user across other services, so I don't save anything by doing ACL inside the DB.

2. I've no idea how to temporarily drop privileges for a single transaction. Connecting as the correct user on each incoming HTTP request is way too slow.