PAF without db user postgres

[asphator]

Hello there

We are currently using paf with dbuser postgres above osuser postgres.
We want to restrict the access to the database even from root some root users.
How should we handle that with paf ?

So far, I've only seen the os-user parameter in the resource definition but doesn't seem to help us here, as they would just switch to su - thatotheruse then psql.
We are thinking about doing a nologin on postgres or setting a password but couldn't figure out how to handle paf if we do so.

Any suggestion ?