diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
index 357f25df0df..cf41baa2063 100644
--- a/doc/src/sgml/user-manag.sgml
+++ b/doc/src/sgml/user-manag.sgml
@@ -530,10 +530,6 @@ DROP ROLE doomed_role;
Execute monitoring functions that may take ACCESS SHARE locks on tables,
potentially for a long time.
-
- pg_signal_backend
- Send signals to other backends (eg: cancel query, terminate).
-
pg_monitor
Read/execute various monitoring views and functions.
@@ -541,6 +537,10 @@ DROP ROLE doomed_role;
pg_read_all_stats and
pg_stat_scan_tables.
+
+ pg_signal_backend
+ Signal another backend to cancel a query or terminate its session.
+
@@ -554,14 +554,23 @@ DROP ROLE doomed_role;
other system information normally restricted to superusers.
+
+ The pg_signal_backend role is intended to allow
+ administrators to enable trusted, but non-superuser, roles to send signals
+ to other backends. Currently this role enables sending of signals for
+ canceling a query on another backend or terminating its session. A user
+ granted this role cannot however send signals to a backend owned by a
+ superuser. See .
+
+
Care should be taken when granting these roles to ensure they are only used where
needed to perform the desired monitoring.
- Administrators can grant access to these roles to users using the GRANT
- command:
+ Administrators can grant access to these roles to users using the
+ command, for example:
GRANT pg_signal_backend TO admin_user;