A significant annoyance is that permissions cannot be encapsulated within a database but are global to the instance, requiring extra consideration at every step

A significant annoyance is that permissions cannot be encapsulated within a database but are global to the instance, requiring extra consideration at every step, from the very logic of your migrations, to how you dump/restore.