The two-identity framing is the part that makes this click for me. Most of the code I see only ever looks at current_user, so an audit check can look completely normal while the session underneath has changed. Including session_user next to current_user in that diagnostic query is a small habit with a big payoff — it tells you who authenticated, not just who is active right now.

The pool warning is also worth underlining. A diagnostic or admin session that leaks into a shared pool is exactly the kind of thing that passes every test and then surprises you in production, because the state only shows up under one specific checkout path. Resetting to a known identity when the session returns to the pool feels like the only safe default.

One question: in practice, do you find SET ROLE covers most of the legitimate cases here, and SESSION AUTHORIZATION is mainly for the rarer long-lived administrative sessions? That would help me decide where the stricter guardrails belong.