* When granting role membership, require the granted-by role to be a role that has appropriate permissions (Robert Haas) This is a requirement even when the superuser is granting role membership.
an exception would be the granted-by is the bootstrap superuser.