superusers.
      </para>
      <para>
       <literal>pg_monitor</literal> allows reading/executing various
       monitoring views and functions.  This role is a member of
       <literal>pg_read_all_settings</literal>,
       <literal>pg_read_all_stats</literal> and
       <literal>pg_stat_scan_tables</literal>.
      </para>
      <para>
       <literal>pg_read_all_settings</literal> allows reading all configuration
       variables, even those normally visible only to superusers.
      </para>
      <para>
       <literal>pg_read_all_stats</literal> allows reading all pg_stat_* views
       and use various statistics related extensions, even those normally
       visible only to superusers.
      </para>
      <para>
       <literal>pg_stat_scan_tables</literal> allows executing monitoring
       functions that may take <literal>ACCESS SHARE</literal> locks on tables,
       potentially for a long time (e.g., <function>pgrowlocks(text)</function>
       in the <xref linkend="pgrowlocks"/> extension).
      </para>
     </listitem>
    </varlistentry>

    <varlistentry id="predefined-role-pg-read-all-data" xreflabel="pg_read_all_data">
     <term><varname>pg_read_all_data</varname></term>
     <term><varname>pg_write_all_data</varname></term>
     <listitem>
      <para>
       <literal>pg_read_all_data</literal> allows reading all data (tables,
       views, sequences), as if having <command>SELECT</command> rights on
       those objects and <literal>USAGE</literal> rights on all schemas.  This
       role does not bypass row-level security (RLS) policies.  If RLS is being
       used, an administrator may wish to set <literal>BYPASSRLS</literal> on
       roles which this role is granted to.
      </para>
      <para>
       <literal>pg_write_all_data</literal> allows writing all data (tables,
       views, sequences), as if having <command>INSERT</command>,
       <command>UPDATE</command>, and <command>DELETE</command> rights on those
       objects and <literal>USAGE</literal> rights on all schemas.  This role
       does not bypass row-level security (RLS) policies.  If RLS is being
       used, an administrator may wish to set <literal>BYPASSRLS</literal> on
       roles which this role is granted to.
      </para>
     </listitem>
    </varlistentry>

    <varlistentry id="predefined-role-pg-read-server-files" xreflabel="pg_read_server_files">
     <term><varname>pg_read_server_files</varname></term>
     <term><varname>pg_write_server_files</varname></term>
     <term><varname>pg_execute_server_program</varname></term>
     <listitem>
      <para>
       These roles are intended to allow administrators to have trusted, but
       non-superuser, roles which are able to access files and run programs on
       the database server as the user the database runs as.  They bypass all
       database-level permission checks when accessing files directly and they
       could be used to gain superuser-level access.  Therefore, great care
       should be taken when granting these roles to users.
      </para>
      <para>
       <literal>pg_read_server_files</literal> allows reading files from any
       location the database can access on the server using
       <command>COPY</command>