Re: Streaming replication as a separate permissions

Robert Haas <robertmhaas@gmail.com> writes:
> On the other hand, the REPLICATION privilege is denying you the right to
> perform an operation *even though you already are authenticated as a
> superuser*.  I don't think there's anywhere else in the system where
> we allow a privilege to non-super-users but deny that same privilege
> to super-users, and I don't think we should be starting now.

You might want to reflect on rolcatupdate a bit before asserting that
there are no cases where privileges are ever denied to superusers.

However, that precedent would suggest that the default should be to
grant the replication bit to superusers.
        regards, tom lane