pub fn select_acl_grantor(
security: &TableSecurity,
privilege: TableAclPrivilege,
current_user: &(impl RoleSubject + ?Sized),
roles: &BTreeMap<String, RoleDefinition>,
memberships: &BTreeMap<RoleMembershipKey, RoleMembership>,
) -> Option<String>