OK, I'm now happy with the issue experts' workflow.

resources/sql/youyesyet.postgres.overrides.sql

@@ -1,3 +1,22 @@
+------------------------------------------------------------------------
+--	User `youyesyet` (the app, and less secure parts of the site)
+--  must have the permissions of `canvassers`.
+------------------------------------------------------------------------
+DO
+$do$
+BEGIN
+   IF NOT EXISTS (
+      SELECT                       -- SELECT list can stay empty for this
+      FROM   pg_catalog.pg_roles
+      WHERE  rolname = 'youyesyet') THEN
+
+      CREATE ROLE youyesyet LOGIN PASSWORD 'thisisnotsecure';
+   END IF;
+END
+$do$;
+
+grant canvassers to youyesyet;
+
 ------------------------------------------------------------------------
 --	convenience view lv_followupactions of entity followupactions for
 --	lists, et cetera