[vasco]

Remove any "if" from your comment and it seems like you understood what would fail! There's more ways to make misunderstanding grant vs default privileges will create issues as well.

[_jhqp]

Then I would argue for trying to centrally ensure that all roles have INHERIT in your DBs. :thinking:

Doing ALTER DEFAULT PRIVILEGES could be another future footgun of it's own.

[csnweb]

I think you probably don’t want the application user to inherit from the superuser you may use for migrations since some migrations require a superuser.