Christophe Pettus: The Call Is Coming From Inside the Session

Role-level timeouts and read-only flags sound safe until you realize the session can change them in one statement.