SU - add enable_grant guc.
SU - handle GRANT restrictions on GRANT/REVOKE for objects and roles.