Two-phase commit security restrictions

What kind of security restrictions do we want for prepared transactions?
Who has the right to finish a transaction that was started by user A? At
least the original user, I suppose, but who else?

Under what account is the transaction manager typically going to run? A
separate TM account perhaps?

Do we need a "GRANT TRANSACTION" command to give permission to finish 2PC
transcations?

Another approach I've been thinking about is to allow anyone that knows
the (user-supplied) global transaction identifier to finish the
transaction, and hide the gids of running transactions from regular users.
That way, the gid acts as a secret token that's only known by the
transaction manager, much like the cancel key.

- Heikki