Is it possible to restrict a role from being able to set arbitrary session variables, or from being able to view them?
select current_setting('x'); show x;
Even after I've switched roles to a one with lesser permissions, I'm able to run both of the above and retrieve a value I might want hidden from that role. I think that it might be possible to lock down the first statement (that's a built-in function, is it not?), but I can't find anything in the documentation about the latter statement concerning grants or permissions.