The PostgreSQL community debates ALTER SYSTEM

> I'd call it a safety instead of a security feature, a bit like having a second button on an electric drill, preventing you or your children from starting it accidentally (but not helping against malicious intent).

That's an excellent way to describe it. It could have saved some of these lengthy debates?

The "children" analogy makes it even better: for obvious redundancy reasons, there is almost always more than one admin for every critical system. But because that redundancy is expensive (time-consuming to train _everyone_), in practice some of the admins are just "backup" admins with limited knowledge of the whole system. So options that disable undesired "alternatives" and other footguns are really no-brainers.