ban-alter-policy-roles

problem

ALTER POLICY ... TO changes which roles the policy applies to. This can change access for existing clients that use those roles. This rule is opt-in. It does not report policy renames or condition-only changes.

ALTER POLICY p ON accounts TO app_user;

solution

Review the affected roles before applying the change. Enable this rule with --include ban-alter-policy-roles.