Dmitry Yemanov wrote:

>"Jim Starkey" <jas@...> wrote:
>
>
>>Nope, he isn't. I have it on very good authority that "Jim" thinks
>>protections should be checked at prepare time.
>>
>>
>
>So, after the active role is changed, should all already prepared statements
>run with the old permissions and should statements being prepared now get
>other permissions?
>
>
>
>

Yes. If a connection can prepare a statement, that statement is valid
until released or the connection closed. Among many other useful
things, this lets an application prepare an insert statement into a log
table before changing to a role that doesn't have write access to the
log table, thereby retaining the ability to write to the log.