You'd need another role to create the user roles and grant them to the app role. It should be possible, though you'd need to use a separately authenticated conn

You'd need another role to create the user roles and grant them to the app role. It should be possible, though you'd need to use a separately authenticated connection if not a separate app to ensure proper isolation.