Context
NAP completed its `[AUTHZ-ONE-ROLE]` migration: the `app_admin` role was removed from `schema.yaml` (roles list, all grants, all policies). Per the RLS spec, "Role drift is reconciled non-destructively: roles are created if missing" — there is no drop path at all.
Grants and policies referencing the removed role DO drop under `--allow-destructive`, which leaves a bare NOLOGIN/NOBYPASSRLS role with no privileges. That is powerless but it is permanent drift: the declarative yaml says the role does not exist, the database says it does, and there is no sanctioned way to converge (NAP is forbidden from hand-written DDL by policy).
Ask
A `DropRoleOperation` emitted when a role exists in the database (and was previously managed — e.g. matches a declared-role naming scope or is recorded in migration state) but is absent from the yaml, gated behind `--allow-destructive` like table/policy drops. Ordering: after all grant revokes and policy drops that reference the role, and it should skip (with a warning) if the role still owns objects or has memberships outside the managed set.
The migration-spec has no section on role drops today; the RLS spec's [RLS-PG-SUPPORT-DDL] only covers create/reassert.
Context
NAP completed its `[AUTHZ-ONE-ROLE]` migration: the `app_admin` role was removed from `schema.yaml` (roles list, all grants, all policies). Per the RLS spec, "Role drift is reconciled non-destructively: roles are created if missing" — there is no drop path at all.
Grants and policies referencing the removed role DO drop under `--allow-destructive`, which leaves a bare NOLOGIN/NOBYPASSRLS role with no privileges. That is powerless but it is permanent drift: the declarative yaml says the role does not exist, the database says it does, and there is no sanctioned way to converge (NAP is forbidden from hand-written DDL by policy).
Ask
A `DropRoleOperation` emitted when a role exists in the database (and was previously managed — e.g. matches a declared-role naming scope or is recorded in migration state) but is absent from the yaml, gated behind `--allow-destructive` like table/policy drops. Ordering: after all grant revokes and policy drops that reference the role, and it should skip (with a warning) if the role still owns objects or has memberships outside the managed set.
The migration-spec has no section on role drops today; the RLS spec's [RLS-PG-SUPPORT-DDL] only covers create/reassert.