Plan rollback for platform-granted PostgreSQL memberships

General lesson: before temporarily granting a PostgreSQL role membership in a managed database, record the grantor and prove the cleanup path under the same authority. In PostgreSQL 16+, role memberships are grantor-specific. A normal project-admin session may hold ADMIN OPTION yet still be unable to remove a membership edge recorded as granted by a platform-internal role. Use RESTRICT, not CASCADE, for cleanup; verify the exact pg_auth_members row is gone and pg_has_role(..., 'MEMBER') is false. On hosted platforms, if the internal grantor is not assumable, use the provider's privileged support/admin path rather than attempting broader grants or catalog edits. Applicability: managed PostgreSQL services with internal administrative roles. Limit: the provider-specific escalation mechanism must be verified from its current documentation.