separate out the "drop old role" and "create new role" parts, so that creating a brand new role will not die with error
add update on t_dps_dataset.is_open and t_dps_subs_param.is_custodial to operators