@@ -94,2 +94,2 @@
-            requiredParent(MANAGED_WEBSPACE), // TODO.spec: or PGSQL_USER?
-            assignedTo(PGSQL_INSTANCE)), // TODO.spec: or swapping parent+assignedTo?
+            requiredParent(PGSQL_USER), // thus, the PGSQL_USER_USER:Agent becomes RBAC owner
+            assignedTo(PGSQL_INSTANCE)), // keep in mind: no RBAC grants implied

@@ -0,0 +23,4 @@
+    @Override
+    protected Pattern identifierPattern(final HsHostingAssetEntity assetEntity) {
+        final var webspaceIdentifier = assetEntity.getParentAsset().getParentAsset().getIdentifier();
+        return Pattern.compile("^"+webspaceIdentifier+"$|^"+webspaceIdentifier+"_[a-z0-9]+$");

@@ -0,0 +28,4 @@
+    @Override
+    protected Pattern identifierPattern(final HsHostingAssetEntity assetEntity) {
+        final var webspaceIdentifier = assetEntity.getParentAsset().getIdentifier();
+        return Pattern.compile("^"+webspaceIdentifier+"$|^"+webspaceIdentifier+"_[a-z0-9]+$");

@@ -0,0 +15,4 @@
+import static net.hostsharing.hsadminng.mapper.PatchMap.entry;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class HsMariaPostgreSqlHostingAssetValidatorUnitTest {

@@ -0,0 +18,4 @@
+class HsMariaPostgreSqlHostingAssetValidatorUnitTest {
+
+    private static final HsHostingAssetEntity GIVEN_MARIADB_INSTANCE = HsHostingAssetEntity.builder()
+            .type(MARIADB_INSTANCE)