Function diff_grants 

pub fn diff_grants(
    target: &[Grant],
    source: &[Grant],
    managed_roles: &BTreeSet<Identifier>,
) -> (Vec<Grant>, Vec<Grant>, Vec<Grant>)

Compute additions and removals between target (catalog) and source (desired).

managed_roles: the set of role names mentioned anywhere in the source catalog. Grants whose grantee is not in this set are considered unmanaged and excluded from the revoke side (lenient policy). PUBLIC is always considered managed.

Returns (to_add, to_revoke, unmanaged_observed).

Caller contract — emit order

Callers must push to_revoke entries into the change-set before to_add entries. This ensures that when a grant’s with_grant_option flag changes (same grantee + privilege + columns, different WGO value), the plan executes REVOKE … FROM … before GRANT … TO … [WITH GRANT OPTION]. Reversing the order causes the GRANT to be immediately undone by the following REVOKE, leaving the live database without the privilege entirely.