Revoke-all then re-grant creates a permission gap on every reconciliation

[Superkooka]

Roles lose all privileges between the revoke and the re-grant, which affects live connections
Plan and reconciliation about it is needed