-- This cant be done in a transaction
ALTER SYSTEM SET anon.masking_policies = 'anon, rgpd';
BEGIN;
CREATE EXTENSION anon CASCADE;
NOTICE:  installing required extension "pgcrypto"
-- ALTER SYSTEM requires to restart the instance for the change to take effect
-- So we force the registration
SELECT anon.register_masking_policy('gdpr');
 register_masking_policy 
-------------------------
 t
(1 row)

SELECT COUNT(*)=2 FROM pg_seclabels WHERE provider='gdpr';
 ?column? 
----------
 t
(1 row)

CREATE ROLE zoe;
SECURITY LABEL FOR gdpr ON ROLE zoe IS 'MASKED';
SELECT COUNT(*)=3 FROM pg_seclabels WHERE provider='gdpr';
 ?column? 
----------
 t
(1 row)

SELECT anon.register_masking_policy('foo; CREATE ROLE alex SUPERUSER LOGIN;');
 register_masking_policy 
-------------------------
 t
(1 row)

ROLLBACK;
ALTER SYSTEM RESET anon.masking_policies;