ensureClauses generates ALTER ROLE clauses, not GRANT statements, so '"DATABASE btcpayserver" = "ALL PRIVILEGES"' produced invalid SQL. ensureDBOwnership = true makes each user own its database, which is the intended effect.