Separate DB credentials for setup vs running?

[Pegasus-RPG]

In an effort to lock down the database, how hard would it be (and what would need to be done) to have one set of DB credentials for schema creation & upgrades that had the required permissions and a second set that was restricted to just those permissions required to operate the system? (E.g. daily use of the application doesn't need to create new tables/functions/sequences so should not have those rights.)

Is there a list of required permissions (or better, a SQL script that sets them,) for both cases?

[ZeiP]

I'm not sure if that currently exists. As the software must anyway have full read & write access to the DB I'm not sure how useful it'd be to restrict the management rights of the same DB. That being said, if there is a solution it should be documented and if one needs to be created I'm of course open to a PR.