DROP SCHEMA IF EXISTS s7 CASCADE;
DROP TABLE IF EXISTS p7;
DROP ROLE IF EXISTS r2;
CREATE ROLE r2;
CREATE SCHEMA s7 AUTHORIZATION r2;
CREATE TABLE p7 (id int PRIMARY KEY, secret text);          -- owned by the current user
CREATE PROPERTY GRAPH s7.pg7 VERTEX TABLES (p7 KEY (id) LABEL l PROPERTIES (id));
ALTER PROPERTY GRAPH s7.pg7 OWNER TO r2;                    -- graph and table owners now differ

SET SESSION AUTHORIZATION r2;

-- show we have no privs on p7
SELECT has_column_privilege('r2', 'p7', 'secret', 'SELECT');

-- but we can still reference it
ALTER PROPERTY GRAPH s7.pg7 ALTER VERTEX TABLE p7 ADD LABEL pin PROPERTIES (secret AS s);

RESET SESSION AUTHORIZATION;

-- which at the very least can prevent DDL, but perhaps also disclose data
ALTER TABLE p7 DROP COLUMN secret;
