Detail: To change another role's password, the current user must have the CREATEROLE attribute and the ADMIN option on the role.
cardant=# GRANT cardant_read_only TO cardant_owner WITH ADMIN TRUE;
GRANT ROLE
Time: 7.732 ms
cardant=# GRANT cardant TO cardant_owner WITH ADMIN TRUE;
GRANT ROLE
Time: 8.552 ms
Same problem as https://github.com/io7m-com/idstore/issues/153.