CREATEROLE allows users to create new roles also having the CREATEDB privilege (at least in version 9.6).
We want special users to be able to CREATEROLE without being able to CREATEDB (eg. when usermanagement is done by the
applicationitself).
Please prevent users with CREATEROLE to create roles having CREATEDB (analogous SUPERUSER and REPLICATION).
Thanks