-- Policy: the root account cannot have delegated users of its own (they
-- would inherit AUTH_USER = 'root' and with it root's page permissions).
-- Creation is now rejected in DelegatedUserManager::createDelegatedUser and
-- login refused in authenticateDelegatedUser; this deactivates any rows
-- created before the policy. Idempotent.
UPDATE whp.delegated_users SET is_active = 0 WHERE parent_username = 'root';
