<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="privileges-provided">
      </a>
      8.2.2 Privileges Provided by MySQL
     </h3>
    </div>
   </div>
  </div>
  <p>
   The privileges granted to a MySQL account determine which
      operations the account can perform. MySQL privileges differ in the
      contexts in which they apply and at different levels of operation:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      Administrative privileges enable users to manage operation of
          the MySQL server. These privileges are global because they are
          not specific to a particular database.
     </p>
    </li>
    <li class="listitem">
     <p>
      Database privileges apply to a database and to all objects
          within it. These privileges can be granted for specific
          databases, or globally so that they apply to all databases.
     </p>
    </li>
    <li class="listitem">
     <p>
      Privileges for database objects such as tables, indexes,
          views, and stored routines can be granted for specific objects
          within a database, for all objects of a given type within a
          database (for example, all tables in a database), or globally
          for all objects of a given type in all databases.
     </p>
    </li>
   </ul>
  </div>
  <p>
   Privileges also differ in terms of whether they are static (built
      in to the server) or dynamic (defined at runtime). Whether a
      privilege is static or dynamic affects its availability to be
      granted to user accounts and roles. For information about the
      differences between static and dynamic privileges, see
   <a class="xref" href="privileges-provided.html#static-dynamic-privileges" title="Static Versus Dynamic Privileges">
    Static Versus Dynamic Privileges
   </a>
   .)
  </p>
  <p>
   Information about account privileges is stored in the grant tables
      in the
   <code class="literal">
    mysql
   </code>
   system database. For a description
      of the structure and contents of these tables, see
   <a class="xref" href="grant-tables.html" title="8.2.3 Grant Tables">
    Section 8.2.3, “Grant Tables”
   </a>
   . The MySQL server reads the
      contents of the grant tables into memory when it starts, and
      reloads them under the circumstances indicated in
   <a class="xref" href="privilege-changes.html" title="8.2.13 When Privilege Changes Take Effect">
    Section 8.2.13, “When Privilege Changes Take Effect”
   </a>
   . The server bases
      access-control decisions on the in-memory copies of the grant
      tables.
  </p>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    Some MySQL releases introduce changes to the grant tables to add
        new privileges or features. To make sure that you can take
        advantage of any new capabilities, update your grant tables to
        the current structure whenever you upgrade MySQL. See
    <a class="xref" href="upgrading.html" title="Chapter 3 Upgrading MySQL">
     Chapter 3,
     <i>
      Upgrading MySQL
     </i>
    </a>
    .
   </p>
  </div>
  <p>
   The following sections summarize the available privileges, provide
      more detailed descriptions of each privilege, and offer usage
      guidelines.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="privileges-provided.html#privileges-provided-summary" title="Summary of Available Privileges">
       Summary of Available Privileges
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="privileges-provided.html#privileges-provided-static" title="Static Privilege Descriptions">
       Static Privilege Descriptions
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="privileges-provided.html#privileges-provided-dynamic" title="Dynamic Privilege Descriptions">
       Dynamic Privilege Descriptions
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="privileges-provided.html#privileges-provided-guidelines" title="Privilege-Granting Guidelines">
       Privilege-Granting Guidelines
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="privileges-provided.html#static-dynamic-privileges" title="Static Versus Dynamic Privileges">
       Static Versus Dynamic Privileges
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="privileges-provided.html#dynamic-privileges-migration-from-super" title="Migrating Accounts from SUPER to Dynamic Privileges">
       Migrating Accounts from SUPER to Dynamic Privileges
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="privileges-provided-summary">
       </a>
       Summary of Available Privileges
      </h4>
     </div>
    </div>
   </div>
   <p>
    The following table shows the static privilege names used in
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    and
    <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
     <code class="literal">
      REVOKE
     </code>
    </a>
    statements, along with the
        column name associated with each privilege in the grant tables
        and the context in which the privilege applies.
   </p>
   <div class="table">
    <a name="idm46045252210080">
    </a>
    <p class="title">
     <b>
      Table 8.2 Permissible Static Privileges for GRANT and REVOKE
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 30%"/>
       <col style="width: 33%"/>
       <col style="width: 37%"/>
      </colgroup>
      <thead>
       <tr>
        <th scope="col">
         Privilege
        </th>
        <th scope="col">
         Grant Table Column
        </th>
        <th scope="col">
         Context
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_all">
          <code class="literal">
           ALL [PRIVILEGES]
          </code>
         </a>
        </th>
        <td>
         Synonym for
         <span class="quote">
          “
          <span class="quote">
           all privileges
          </span>
          ”
         </span>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_alter">
          <code class="literal">
           ALTER
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Alter_priv
         </code>
        </td>
        <td>
         Tables
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_alter-routine">
          <code class="literal">
           ALTER ROUTINE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Alter_routine_priv
         </code>
        </td>
        <td>
         Stored routines
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create">
          <code class="literal">
           CREATE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_priv
         </code>
        </td>
        <td>
         Databases, tables, or indexes
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create-role">
          <code class="literal">
           CREATE ROLE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_role_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create-routine">
          <code class="literal">
           CREATE ROUTINE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_routine_priv
         </code>
        </td>
        <td>
         Stored routines
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create-tablespace">
          <code class="literal">
           CREATE TABLESPACE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_tablespace_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create-temporary-tables">
          <code class="literal">
           CREATE TEMPORARY TABLES
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_tmp_table_priv
         </code>
        </td>
        <td>
         Tables
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create-user">
          <code class="literal">
           CREATE USER
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_user_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_create-view">
          <code class="literal">
           CREATE VIEW
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Create_view_priv
         </code>
        </td>
        <td>
         Views
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_delete">
          <code class="literal">
           DELETE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Delete_priv
         </code>
        </td>
        <td>
         Tables
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_drop">
          <code class="literal">
           DROP
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Drop_priv
         </code>
        </td>
        <td>
         Databases, tables, or views
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_drop-role">
          <code class="literal">
           DROP ROLE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Drop_role_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_event">
          <code class="literal">
           EVENT
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Event_priv
         </code>
        </td>
        <td>
         Databases
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_execute">
          <code class="literal">
           EXECUTE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Execute_priv
         </code>
        </td>
        <td>
         Stored routines
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_file">
          <code class="literal">
           FILE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          File_priv
         </code>
        </td>
        <td>
         File access on server host
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_grant-option">
          <code class="literal">
           GRANT OPTION
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Grant_priv
         </code>
        </td>
        <td>
         Databases, tables, or stored routines
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_index">
          <code class="literal">
           INDEX
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Index_priv
         </code>
        </td>
        <td>
         Tables
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_insert">
          <code class="literal">
           INSERT
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Insert_priv
         </code>
        </td>
        <td>
         Tables or columns
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_lock-tables">
          <code class="literal">
           LOCK TABLES
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Lock_tables_priv
         </code>
        </td>
        <td>
         Databases
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_process">
          <code class="literal">
           PROCESS
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Process_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_proxy">
          <code class="literal">
           PROXY
          </code>
         </a>
        </th>
        <td>
         See
         <code class="literal">
          proxies_priv
         </code>
         table
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_references">
          <code class="literal">
           REFERENCES
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          References_priv
         </code>
        </td>
        <td>
         Databases or tables
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_reload">
          <code class="literal">
           RELOAD
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Reload_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_replication-client">
          <code class="literal">
           REPLICATION CLIENT
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Repl_client_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_replication-slave">
          <code class="literal">
           REPLICATION SLAVE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Repl_slave_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_select">
          <code class="literal">
           SELECT
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Select_priv
         </code>
        </td>
        <td>
         Tables or columns
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_show-databases">
          <code class="literal">
           SHOW DATABASES
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Show_db_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_show-view">
          <code class="literal">
           SHOW VIEW
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Show_view_priv
         </code>
        </td>
        <td>
         Views
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_shutdown">
          <code class="literal">
           SHUTDOWN
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Shutdown_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_super">
          <code class="literal">
           SUPER
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Super_priv
         </code>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_trigger">
          <code class="literal">
           TRIGGER
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Trigger_priv
         </code>
        </td>
        <td>
         Tables
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_update">
          <code class="literal">
           UPDATE
          </code>
         </a>
        </th>
        <td>
         <code class="literal">
          Update_priv
         </code>
        </td>
        <td>
         Tables or columns
        </td>
       </tr>
       <tr>
        <th scope="row">
         <a class="link" href="privileges-provided.html#priv_usage">
          <code class="literal">
           USAGE
          </code>
         </a>
        </th>
        <td>
         Synonym for
         <span class="quote">
          “
          <span class="quote">
           no privileges
          </span>
          ”
         </span>
        </td>
        <td>
         Server administration
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 647px;">
      <thead>
       <tr>
        <th scope="col" style="width: 193.875px;">
         Privilege
        </th>
        <th scope="col" style="width: 213.266px;">
         Grant Table Column
        </th>
        <th scope="col" style="width: 239.156px;">
         Context
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
   <p>
    The following table shows the dynamic privilege names used in
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    and
    <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
     <code class="literal">
      REVOKE
     </code>
    </a>
    statements, along with the
        context in which the privilege applies.
   </p>
   <div class="table">
    <a name="idm46045252038592">
    </a>
    <p class="title">
     <b>
      Table 8.3 Permissible Dynamic Privileges for GRANT and REVOKE
     </b>
    </p>
    <div class="table-contents">
     <table>
      <colgroup>
       <col style="width: 35%"/>
       <col style="width: 45%"/>
      </colgroup>
      <thead>
       <tr>
        <th>
         Privilege
        </th>
        <th>
         Context
        </th>
       </tr>
      </thead>
      <tbody>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_allow-nonexistent-definer">
          <code class="literal">
           ALLOW_NONEXISTENT_DEFINER
          </code>
         </a>
        </td>
        <td>
         Orphan object protection
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_application-password-admin">
          <code class="literal">
           APPLICATION_PASSWORD_ADMIN
          </code>
         </a>
        </td>
        <td>
         Dual password administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
          <code class="literal">
           AUDIT_ABORT_EXEMPT
          </code>
         </a>
        </td>
        <td>
         Allow queries blocked by audit log filter
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_audit-admin">
          <code class="literal">
           AUDIT_ADMIN
          </code>
         </a>
        </td>
        <td>
         Audit log administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
          <code class="literal">
           AUTHENTICATION_POLICY_ADMIN
          </code>
         </a>
        </td>
        <td>
         Authentication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_backup-admin">
          <code class="literal">
           BACKUP_ADMIN
          </code>
         </a>
        </td>
        <td>
         Backup administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_binlog-admin">
          <code class="literal">
           BINLOG_ADMIN
          </code>
         </a>
        </td>
        <td>
         Backup and Replication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_binlog-encryption-admin">
          <code class="literal">
           BINLOG_ENCRYPTION_ADMIN
          </code>
         </a>
        </td>
        <td>
         Backup and Replication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_clone-admin">
          <code class="literal">
           CLONE_ADMIN
          </code>
         </a>
        </td>
        <td>
         Clone administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_connection-admin">
          <code class="literal">
           CONNECTION_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_encryption-key-admin">
          <code class="literal">
           ENCRYPTION_KEY_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_firewall-admin">
          <code class="literal">
           FIREWALL_ADMIN
          </code>
         </a>
        </td>
        <td>
         Firewall administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_firewall-exempt">
          <code class="literal">
           FIREWALL_EXEMPT
          </code>
         </a>
        </td>
        <td>
         Firewall administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_firewall-user">
          <code class="literal">
           FIREWALL_USER
          </code>
         </a>
        </td>
        <td>
         Firewall administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_flush-optimizer-costs">
          <code class="literal">
           FLUSH_OPTIMIZER_COSTS
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_flush-privileges">
          <code class="literal">
           FLUSH_PRIVILEGES
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_flush-status">
          <code class="literal">
           FLUSH_STATUS
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_flush-tables">
          <code class="literal">
           FLUSH_TABLES
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_flush-user-resources">
          <code class="literal">
           FLUSH_USER_RESOURCES
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_group-replication-admin">
          <code class="literal">
           GROUP_REPLICATION_ADMIN
          </code>
         </a>
        </td>
        <td>
         Replication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_group-replication-stream">
          <code class="literal">
           GROUP_REPLICATION_STREAM
          </code>
         </a>
        </td>
        <td>
         Replication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_innodb-redo-log-archive">
          <code class="literal">
           INNODB_REDO_LOG_ARCHIVE
          </code>
         </a>
        </td>
        <td>
         Redo log archiving administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_innodb-redo-log-enable">
          <code class="literal">
           INNODB_REDO_LOG_ENABLE
          </code>
         </a>
        </td>
        <td>
         Redo log administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_masking-dictionaries-admin">
          <code class="literal">
           MASKING_DICTIONARIES_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_ndb-stored-user">
          <code class="literal">
           NDB_STORED_USER
          </code>
         </a>
        </td>
        <td>
         NDB Cluster
        </td>
       </tr>
       <tr>
        <td scope="row">
         <a class="link" href="privileges-provided.html#priv_optimize-local-table">
          <code class="literal">
           OPTIMIZE_LOCAL_TABLE
          </code>
         </a>
        </td>
        <td>
         <a class="link" href="optimize-table.html" title="15.7.3.4 OPTIMIZE TABLE Statement">
          <code class="literal">
           OPTIMIZE LOCAL
              TABLE
          </code>
         </a>
         statements
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
          <code class="literal">
           PASSWORDLESS_USER_ADMIN
          </code>
         </a>
        </td>
        <td>
         Authentication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_persist-ro-variables-admin">
          <code class="literal">
           PERSIST_RO_VARIABLES_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_replication-applier">
          <code class="literal">
           REPLICATION_APPLIER
          </code>
         </a>
        </td>
        <td>
         <code class="literal">
          PRIVILEGE_CHECKS_USER
         </code>
         for a replication channel
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_replication-slave-admin">
          <code class="literal">
           REPLICATION_SLAVE_ADMIN
          </code>
         </a>
        </td>
        <td>
         Replication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_resource-group-admin">
          <code class="literal">
           RESOURCE_GROUP_ADMIN
          </code>
         </a>
        </td>
        <td>
         Resource group administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_resource-group-user">
          <code class="literal">
           RESOURCE_GROUP_USER
          </code>
         </a>
        </td>
        <td>
         Resource group administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_role-admin">
          <code class="literal">
           ROLE_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_sensitive-variables-observer">
          <code class="literal">
           SENSITIVE_VARIABLES_OBSERVER
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_session-variables-admin">
          <code class="literal">
           SESSION_VARIABLES_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_set-any-definer">
          <code class="literal">
           SET_ANY_DEFINER
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_show-routine">
          <code class="literal">
           SHOW_ROUTINE
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_skip-query-rewrite">
          <code class="literal">
           SKIP_QUERY_REWRITE
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_system-user">
          <code class="literal">
           SYSTEM_USER
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_system-variables-admin">
          <code class="literal">
           SYSTEM_VARIABLES_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_table-encryption-admin">
          <code class="literal">
           TABLE_ENCRYPTION_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_telemetry-log-admin">
          <code class="literal">
           TELEMETRY_LOG_ADMIN
          </code>
         </a>
        </td>
        <td>
         Telemetry log administration for HeatWave on AWS
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_tp-connection-admin">
          <code class="literal">
           TP_CONNECTION_ADMIN
          </code>
         </a>
        </td>
        <td>
         Thread pool administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_transaction-gtid-tag">
          <code class="literal">
           TRANSACTION_GTID_TAG
          </code>
         </a>
        </td>
        <td>
         Replication administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_version-token-admin">
          <code class="literal">
           VERSION_TOKEN_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
       <tr>
        <td>
         <a class="link" href="privileges-provided.html#priv_xa-recover-admin">
          <code class="literal">
           XA_RECOVER_ADMIN
          </code>
         </a>
        </td>
        <td>
         Server administration
        </td>
       </tr>
      </tbody>
     </table>
    </div>
    <div class="table-contents">
     <table cellpadding="0" cellspacing="0" style="position: fixed; top: 0px; display: none; left: 401px; width: 739px;">
      <thead>
       <tr>
        <th style="width: 322.875px;">
         Privilege
        </th>
        <th style="width: 415.125px;">
         Context
        </th>
       </tr>
      </thead>
     </table>
    </div>
   </div>
   <br class="table-break"/>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="privileges-provided-static">
       </a>
       Static Privilege Descriptions
      </h4>
     </div>
    </div>
   </div>
   <p>
    Static privileges are built in to the server, in contrast to
        dynamic privileges, which are defined at runtime. The following
        list describes each static privilege available in MySQL.
   </p>
   <p>
    Particular SQL statements might have more specific privilege
        requirements than indicated here. If so, the description for the
        statement in question provides the details.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="priv_all">
       </a>
       <a class="link" href="privileges-provided.html#priv_all">
        <code class="literal">
         ALL
        </code>
       </a>
       ,
       <a class="link" href="privileges-provided.html#priv_all">
        <code class="literal">
         ALL
            PRIVILEGES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251878592">
      </a>
      <a class="indexterm" name="idm46045251877136">
      </a>
      <a class="indexterm" name="idm46045251876064">
      </a>
      <a class="indexterm" name="idm46045251874576">
      </a>
      <p>
       These privilege specifiers are shorthand for
       <span class="quote">
        “
        <span class="quote">
         all
            privileges available at a given privilege level
        </span>
        ”
       </span>
       (except
       <a class="link" href="privileges-provided.html#priv_grant-option">
        <code class="literal">
         GRANT OPTION
        </code>
       </a>
       ). For
            example, granting
       <a class="link" href="privileges-provided.html#priv_all">
        <code class="literal">
         ALL
        </code>
       </a>
       at the
            global or table level grants all global privileges or all
            table-level privileges, respectively.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_alter">
       </a>
       <a class="link" href="privileges-provided.html#priv_alter">
        <code class="literal">
         ALTER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251867552">
      </a>
      <a class="indexterm" name="idm46045251866064">
      </a>
      <p>
       Enables use of the
       <a class="link" href="alter-table.html" title="15.1.9 ALTER TABLE Statement">
        <code class="literal">
         ALTER
            TABLE
        </code>
       </a>
       statement to change the structure of tables.
       <a class="link" href="alter-table.html" title="15.1.9 ALTER TABLE Statement">
        <code class="literal">
         ALTER TABLE
        </code>
       </a>
       also requires the
       <a class="link" href="privileges-provided.html#priv_create">
        <code class="literal">
         CREATE
        </code>
       </a>
       and
       <a class="link" href="privileges-provided.html#priv_insert">
        <code class="literal">
         INSERT
        </code>
       </a>
       privileges. Renaming a
            table requires
       <a class="link" href="privileges-provided.html#priv_alter">
        <code class="literal">
         ALTER
        </code>
       </a>
       and
       <a class="link" href="privileges-provided.html#priv_drop">
        <code class="literal">
         DROP
        </code>
       </a>
       on the old table,
       <a class="link" href="privileges-provided.html#priv_create">
        <code class="literal">
         CREATE
        </code>
       </a>
       , and
       <a class="link" href="privileges-provided.html#priv_insert">
        <code class="literal">
         INSERT
        </code>
       </a>
       on the new table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_alter-routine">
       </a>
       <a class="link" href="privileges-provided.html#priv_alter-routine">
        <code class="literal">
         ALTER ROUTINE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251852176">
      </a>
      <a class="indexterm" name="idm46045251850688">
      </a>
      <p>
       Enables use of statements that alter or drop stored routines
            (stored procedures and functions). For routines that fall
            within the scope at which the privilege is granted and for
            which the user is not the user named as the routine
       <code class="literal">
        DEFINER
       </code>
       , also enables access to routine
            properties other than the routine definition.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create">
       </a>
       <a class="link" href="privileges-provided.html#priv_create">
        <code class="literal">
         CREATE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251845792">
      </a>
      <a class="indexterm" name="idm46045251844304">
      </a>
      <p>
       Enables use of statements that create new databases and
            tables.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create-role">
       </a>
       <a class="link" href="privileges-provided.html#priv_create-role">
        <code class="literal">
         CREATE ROLE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251840336">
      </a>
      <a class="indexterm" name="idm46045251838848">
      </a>
      <p>
       Enables use of the
       <a class="link" href="create-role.html" title="15.7.1.2 CREATE ROLE Statement">
        <code class="literal">
         CREATE
            ROLE
        </code>
       </a>
       statement. (The
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE
            USER
        </code>
       </a>
       privilege also enables use of the
       <a class="link" href="create-role.html" title="15.7.1.2 CREATE ROLE Statement">
        <code class="literal">
         CREATE ROLE
        </code>
       </a>
       statement.) See
       <a class="xref" href="roles.html" title="8.2.10 Using Roles">
        Section 8.2.10, “Using Roles”
       </a>
       .
      </p>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_create-role">
        <code class="literal">
         CREATE ROLE
        </code>
       </a>
       and
       <a class="link" href="privileges-provided.html#priv_drop-role">
        <code class="literal">
         DROP ROLE
        </code>
       </a>
       privileges are not
            as powerful as
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       because they can be used only to create and drop accounts.
            They cannot be used as
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE
            USER
        </code>
       </a>
       can be modify account attributes or rename
            accounts. See
       <a class="xref" href="roles.html#role-user-interchangeability" title="User and Role Interchangeability">
        User and Role Interchangeability
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create-routine">
       </a>
       <a class="link" href="privileges-provided.html#priv_create-routine">
        <code class="literal">
         CREATE ROUTINE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251823984">
      </a>
      <a class="indexterm" name="idm46045251822496">
      </a>
      <p>
       Enables use of statements that create stored routines
            (stored procedures and functions). For routines that fall
            within the scope at which the privilege is granted and for
            which the user is not the user named as the routine
       <code class="literal">
        DEFINER
       </code>
       , also enables access to routine
            properties other than the routine definition.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create-tablespace">
       </a>
       <a class="link" href="privileges-provided.html#priv_create-tablespace">
        <code class="literal">
         CREATE TABLESPACE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251817584">
      </a>
      <a class="indexterm" name="idm46045251816096">
      </a>
      <p>
       Enables use of statements that create, alter, or drop
            tablespaces and log file groups.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create-temporary-tables">
       </a>
       <a class="link" href="privileges-provided.html#priv_create-temporary-tables">
        <code class="literal">
         CREATE TEMPORARY TABLES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251811968">
      </a>
      <a class="indexterm" name="idm46045251810480">
      </a>
      <p>
       Enables the creation of temporary tables using the
       <a class="link" href="create-temporary-table.html" title="15.1.20.2 CREATE TEMPORARY TABLE Statement">
        <code class="literal">
         CREATE TEMPORARY TABLE
        </code>
       </a>
       statement.
      </p>
      <a class="indexterm" name="idm46045251807648">
      </a>
      <a class="indexterm" name="idm46045251806160">
      </a>
      <p>
       After a session has created a temporary table, the server
            performs no further privilege checks on the table. The
            creating session can perform any operation on the table,
            such as
       <a class="link" href="drop-table.html" title="15.1.32 DROP TABLE Statement">
        <code class="literal">
         DROP TABLE
        </code>
       </a>
       ,
       <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
        <code class="literal">
         INSERT
        </code>
       </a>
       ,
       <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
        <code class="literal">
         UPDATE
        </code>
       </a>
       , or
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       . For more information,
            see
       <a class="xref" href="create-temporary-table.html" title="15.1.20.2 CREATE TEMPORARY TABLE Statement">
        Section 15.1.20.2, “CREATE TEMPORARY TABLE Statement”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create-user">
       </a>
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251796416">
      </a>
      <a class="indexterm" name="idm46045251794928">
      </a>
      <p>
       Enables use of the
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER
            USER
        </code>
       </a>
       ,
       <a class="link" href="create-role.html" title="15.7.1.2 CREATE ROLE Statement">
        <code class="literal">
         CREATE ROLE
        </code>
       </a>
       ,
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       ,
       <a class="link" href="drop-role.html" title="15.7.1.4 DROP ROLE Statement">
        <code class="literal">
         DROP ROLE
        </code>
       </a>
       ,
       <a class="link" href="drop-user.html" title="15.7.1.5 DROP USER Statement">
        <code class="literal">
         DROP USER
        </code>
       </a>
       ,
       <a class="link" href="rename-user.html" title="15.7.1.7 RENAME USER Statement">
        <code class="literal">
         RENAME USER
        </code>
       </a>
       , and
       <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
        <code class="literal">
         REVOKE ALL
            PRIVILEGES
        </code>
       </a>
       statements.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_create-view">
       </a>
       <a class="link" href="privileges-provided.html#priv_create-view">
        <code class="literal">
         CREATE VIEW
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251782480">
      </a>
      <a class="indexterm" name="idm46045251780992">
      </a>
      <p>
       Enables use of the
       <a class="link" href="create-view.html" title="15.1.23 CREATE VIEW Statement">
        <code class="literal">
         CREATE
            VIEW
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_delete">
       </a>
       <a class="link" href="privileges-provided.html#priv_delete">
        <code class="literal">
         DELETE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251775856">
      </a>
      <a class="indexterm" name="idm46045251774368">
      </a>
      <p>
       Enables rows to be deleted from tables in a database.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_drop">
       </a>
       <a class="link" href="privileges-provided.html#priv_drop">
        <code class="literal">
         DROP
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251770480">
      </a>
      <a class="indexterm" name="idm46045251768992">
      </a>
      <p>
       Enables use of statements that drop (remove) existing
            databases, tables, and views. The
       <a class="link" href="privileges-provided.html#priv_drop">
        <code class="literal">
         DROP
        </code>
       </a>
       privilege is required to
            use the
       <code class="literal">
        ALTER TABLE ... DROP PARTITION
       </code>
       statement on a partitioned table. The
       <a class="link" href="privileges-provided.html#priv_drop">
        <code class="literal">
         DROP
        </code>
       </a>
       privilege is also
            required for
       <a class="link" href="truncate-table.html" title="15.1.37 TRUNCATE TABLE Statement">
        <code class="literal">
         TRUNCATE TABLE
        </code>
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_drop-role">
       </a>
       <a class="link" href="privileges-provided.html#priv_drop-role">
        <code class="literal">
         DROP ROLE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251760448">
      </a>
      <a class="indexterm" name="idm46045251758960">
      </a>
      <p>
       Enables use of the
       <a class="link" href="drop-role.html" title="15.7.1.4 DROP ROLE Statement">
        <code class="literal">
         DROP ROLE
        </code>
       </a>
       statement. (The
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       privilege also enables use of the
       <a class="link" href="drop-role.html" title="15.7.1.4 DROP ROLE Statement">
        <code class="literal">
         DROP
            ROLE
        </code>
       </a>
       statement.) See
       <a class="xref" href="roles.html" title="8.2.10 Using Roles">
        Section 8.2.10, “Using Roles”
       </a>
       .
      </p>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_create-role">
        <code class="literal">
         CREATE ROLE
        </code>
       </a>
       and
       <a class="link" href="privileges-provided.html#priv_drop-role">
        <code class="literal">
         DROP ROLE
        </code>
       </a>
       privileges are not
            as powerful as
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       because they can be used only to create and drop accounts.
            They cannot be used as
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE
            USER
        </code>
       </a>
       can be modify account attributes or rename
            accounts. See
       <a class="xref" href="roles.html#role-user-interchangeability" title="User and Role Interchangeability">
        User and Role Interchangeability
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_event">
       </a>
       <a class="link" href="privileges-provided.html#priv_event">
        <code class="literal">
         EVENT
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251744400">
      </a>
      <a class="indexterm" name="idm46045251742912">
      </a>
      <p>
       Enables use of statements that create, alter, drop, or
            display events for the Event Scheduler.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_execute">
       </a>
       <a class="link" href="privileges-provided.html#priv_execute">
        <code class="literal">
         EXECUTE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251738912">
      </a>
      <a class="indexterm" name="idm46045251737424">
      </a>
      <p>
       Enables use of statements that execute stored routines
            (stored procedures and functions). For routines that fall
            within the scope at which the privilege is granted and for
            which the user is not the user named as the routine
       <code class="literal">
        DEFINER
       </code>
       , also enables access to routine
            properties other than the routine definition.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_file">
       </a>
       <a class="link" href="privileges-provided.html#priv_file">
        <code class="literal">
         FILE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251732464">
      </a>
      <a class="indexterm" name="idm46045251730976">
      </a>
      <p>
       Affects the following operations and server behaviors:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Enables reading and writing files on the server host
                using the
          <a class="link" href="load-data.html" title="15.2.9 LOAD DATA Statement">
           <code class="literal">
            LOAD DATA
           </code>
          </a>
          and
          <a class="link" href="select-into.html" title="15.2.13.1 SELECT ... INTO Statement">
           <code class="literal">
            SELECT ...
                INTO OUTFILE
           </code>
          </a>
          statements and the
          <a class="link" href="string-functions.html#function_load-file">
           <code class="literal">
            LOAD_FILE()
           </code>
          </a>
          function. A
                user who has the
          <a class="link" href="privileges-provided.html#priv_file">
           <code class="literal">
            FILE
           </code>
          </a>
          privilege can read any file on the server host that is
                either world-readable or readable by the MySQL server.
                (This implies the user can read any file in any database
                directory, because the server can access any of those
                files.)
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables creating new files in any directory where the
                MySQL server has write access. This includes the
                server's data directory containing the files that
                implement the privilege tables.
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables use of the
          <code class="literal">
           DATA DIRECTORY
          </code>
          or
          <code class="literal">
           INDEX DIRECTORY
          </code>
          table option for the
          <a class="link" href="create-table.html" title="15.1.20 CREATE TABLE Statement">
           <code class="literal">
            CREATE TABLE
           </code>
          </a>
          statement.
         </p>
        </li>
       </ul>
      </div>
      <p>
       As a security measure, the server does not overwrite
            existing files.
      </p>
      <p>
       To limit the location in which files can be read and
            written, set the
       <a class="link" href="server-system-variables.html#sysvar_secure_file_priv">
        <code class="literal">
         secure_file_priv
        </code>
       </a>
       system
            variable to a specific directory. See
       <a class="xref" href="server-system-variables.html" title="7.1.8 Server System Variables">
        Section 7.1.8, “Server System Variables”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_grant-option">
       </a>
       <a class="link" href="privileges-provided.html#priv_grant-option">
        <code class="literal">
         GRANT OPTION
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251712912">
      </a>
      <a class="indexterm" name="idm46045251711424">
      </a>
      <p>
       Enables you to grant to or revoke from other users those
            privileges that you yourself possess.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_index">
       </a>
       <a class="link" href="privileges-provided.html#priv_index">
        <code class="literal">
         INDEX
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251707424">
      </a>
      <a class="indexterm" name="idm46045251705936">
      </a>
      <p>
       Enables use of statements that create or drop (remove)
            indexes.
       <a class="link" href="privileges-provided.html#priv_index">
        <code class="literal">
         INDEX
        </code>
       </a>
       applies to
            existing tables. If you have the
       <a class="link" href="privileges-provided.html#priv_create">
        <code class="literal">
         CREATE
        </code>
       </a>
       privilege for a table,
            you can include index definitions in the
       <a class="link" href="create-table.html" title="15.1.20 CREATE TABLE Statement">
        <code class="literal">
         CREATE TABLE
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_insert">
       </a>
       <a class="link" href="privileges-provided.html#priv_insert">
        <code class="literal">
         INSERT
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251698144">
      </a>
      <a class="indexterm" name="idm46045251696656">
      </a>
      <p>
       Enables rows to be inserted into tables in a database.
       <a class="link" href="privileges-provided.html#priv_insert">
        <code class="literal">
         INSERT
        </code>
       </a>
       is also required for
            the
       <a class="link" href="analyze-table.html" title="15.7.3.1 ANALYZE TABLE Statement">
        <code class="literal">
         ANALYZE TABLE
        </code>
       </a>
       ,
       <a class="link" href="optimize-table.html" title="15.7.3.4 OPTIMIZE TABLE Statement">
        <code class="literal">
         OPTIMIZE TABLE
        </code>
       </a>
       , and
       <a class="link" href="repair-table.html" title="15.7.3.5 REPAIR TABLE Statement">
        <code class="literal">
         REPAIR TABLE
        </code>
       </a>
       table-maintenance statements.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_lock-tables">
       </a>
       <a class="link" href="privileges-provided.html#priv_lock-tables">
        <code class="literal">
         LOCK TABLES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251687728">
      </a>
      <a class="indexterm" name="idm46045251686240">
      </a>
      <p>
       Enables use of explicit
       <a class="link" href="lock-tables.html" title="15.3.6 LOCK TABLES and UNLOCK TABLES Statements">
        <code class="literal">
         LOCK
            TABLES
        </code>
       </a>
       statements to lock tables for which you
            have the
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
       privilege.
            This includes use of write locks, which prevents other
            sessions from reading the locked table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_process">
       </a>
       <a class="link" href="privileges-provided.html#priv_process">
        <code class="literal">
         PROCESS
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251679696">
      </a>
      <a class="indexterm" name="idm46045251678208">
      </a>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_process">
        <code class="literal">
         PROCESS
        </code>
       </a>
       privilege
            controls access to information about threads executing
            within the server (that is, information about statements
            being executed by sessions). Thread information available
            using the
       <a class="link" href="show-processlist.html" title="15.7.7.31 SHOW PROCESSLIST Statement">
        <code class="literal">
         SHOW PROCESSLIST
        </code>
       </a>
       statement, the
       <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
        <span class="command">
         <strong>
          mysqladmin processlist
         </strong>
        </span>
       </a>
       command, the Information Schema
       <a class="link" href="information-schema-processlist-table.html" title="28.3.23 The INFORMATION_SCHEMA PROCESSLIST Table">
        <code class="literal">
         PROCESSLIST
        </code>
       </a>
       table, and the
            Performance Schema
       <a class="link" href="performance-schema-processlist-table.html" title="29.12.22.7 The processlist Table">
        <code class="literal">
         processlist
        </code>
       </a>
       table is accessible as follows:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          With the
          <a class="link" href="privileges-provided.html#priv_process">
           <code class="literal">
            PROCESS
           </code>
          </a>
          privilege, a user has access to information about all
                threads, even those belonging to other users.
         </p>
        </li>
        <li class="listitem">
         <p>
          Without the
          <a class="link" href="privileges-provided.html#priv_process">
           <code class="literal">
            PROCESS
           </code>
          </a>
          privilege, nonanonymous users have access to information
                about their own threads but not threads for other users,
                and anonymous users have no access to thread
                information.
         </p>
        </li>
       </ul>
      </div>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        The Performance Schema
        <a class="link" href="performance-schema-threads-table.html" title="29.12.22.8 The threads Table">
         <code class="literal">
          threads
         </code>
        </a>
        table also provides
              thread information, but table access uses a different
              privilege model. See
        <a class="xref" href="performance-schema-threads-table.html" title="29.12.22.8 The threads Table">
         Section 29.12.22.8, “The threads Table”
        </a>
        .
       </p>
      </div>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_process">
        <code class="literal">
         PROCESS
        </code>
       </a>
       privilege also
            enables use of the
       <a class="link" href="show-engine.html" title="15.7.7.16 SHOW ENGINE Statement">
        <code class="literal">
         SHOW
            ENGINE
        </code>
       </a>
       statement, access to the
       <code class="literal">
        INFORMATION_SCHEMA
       </code>
       <code class="literal">
        InnoDB
       </code>
       tables (tables with names that
            begin with
       <code class="literal">
        INNODB_
       </code>
       ), and access to the
       <code class="literal">
        INFORMATION_SCHEMA
       </code>
       <a class="link" href="information-schema-files-table.html" title="28.3.15 The INFORMATION_SCHEMA FILES Table">
        <code class="literal">
         FILES
        </code>
       </a>
       table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_proxy">
       </a>
       <a class="link" href="privileges-provided.html#priv_proxy">
        <code class="literal">
         PROXY
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251652624">
      </a>
      <a class="indexterm" name="idm46045251651136">
      </a>
      <p>
       Enables one user to impersonate or become known as another
            user. See
       <a class="xref" href="proxy-users.html" title="8.2.19 Proxy Users">
        Section 8.2.19, “Proxy Users”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_references">
       </a>
       <a class="link" href="privileges-provided.html#priv_references">
        <code class="literal">
         REFERENCES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251646496">
      </a>
      <a class="indexterm" name="idm46045251645008">
      </a>
      <p>
       Creation of a foreign key constraint requires the
       <a class="link" href="privileges-provided.html#priv_references">
        <code class="literal">
         REFERENCES
        </code>
       </a>
       privilege for the
            parent table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_reload">
       </a>
       <a class="link" href="privileges-provided.html#priv_reload">
        <code class="literal">
         RELOAD
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251639856">
      </a>
      <a class="indexterm" name="idm46045251638368">
      </a>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_reload">
        <code class="literal">
         RELOAD
        </code>
       </a>
       enables the
            following operations:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Use of the
          <a class="link" href="flush.html" title="15.7.8.3 FLUSH Statement">
           <code class="literal">
            FLUSH
           </code>
          </a>
          statement.
         </p>
        </li>
        <li class="listitem">
         <p>
          Use of
          <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
           <span class="command">
            <strong>
             mysqladmin
            </strong>
           </span>
          </a>
          commands that are
                equivalent to
          <a class="link" href="flush.html" title="15.7.8.3 FLUSH Statement">
           <code class="literal">
            FLUSH
           </code>
          </a>
          operations:
          <code class="literal">
           flush-hosts
          </code>
          ,
          <code class="literal">
           flush-logs
          </code>
          ,
          <code class="literal">
           flush-privileges
          </code>
          ,
          <code class="literal">
           flush-status
          </code>
          ,
          <code class="literal">
           flush-tables
          </code>
          ,
          <code class="literal">
           refresh
          </code>
          , and
          <code class="literal">
           reload
          </code>
          .
         </p>
         <p>
          The
          <code class="literal">
           reload
          </code>
          command tells the server
                to reload the grant tables into memory.
          <code class="literal">
           flush-privileges
          </code>
          is a synonym for
          <code class="literal">
           reload
          </code>
          . The
          <code class="literal">
           refresh
          </code>
          command closes and reopens
                the log files and flushes all tables. The other
          <code class="literal">
           flush-
           <em class="replaceable">
            <code>
             xxx
            </code>
           </em>
          </code>
          commands perform functions similar to
          <code class="literal">
           refresh
          </code>
          , but are more specific and
                may be preferable in some instances. For example, if you
                want to flush just the log files,
          <code class="literal">
           flush-logs
          </code>
          is a better choice than
          <code class="literal">
           refresh
          </code>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Use of
          <a class="link" href="mysqldump.html" title="6.5.4 mysqldump — A Database Backup Program">
           <span class="command">
            <strong>
             mysqldump
            </strong>
           </span>
          </a>
          options that perform
                various
          <a class="link" href="flush.html" title="15.7.8.3 FLUSH Statement">
           <code class="literal">
            FLUSH
           </code>
          </a>
          operations:
          <a class="link" href="mysqldump.html#option_mysqldump_flush-logs">
           <code class="option">
            --flush-logs
           </code>
          </a>
          and
          <a class="link" href="mysqldump.html#option_mysqldump_source-data">
           <code class="option">
            --source-data
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Use of the
          <a class="link" href="reset-binary-logs-and-gtids.html" title="15.4.1.2 RESET BINARY LOGS AND GTIDS Statement">
           <code class="literal">
            RESET BINARY LOGS AND
                GTIDS
           </code>
          </a>
          and
          <a class="link" href="reset-replica.html" title="15.4.2.3 RESET REPLICA Statement">
           <code class="literal">
            RESET
                REPLICA
           </code>
          </a>
          statements.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_replication-client">
       </a>
       <a class="link" href="privileges-provided.html#priv_replication-client">
        <code class="literal">
         REPLICATION CLIENT
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251606832">
      </a>
      <a class="indexterm" name="idm46045251605344">
      </a>
      <p>
       Enables use of the
       <a class="link" href="show-binary-log-status.html" title="15.7.7.1 SHOW BINARY LOG STATUS Statement">
        <code class="literal">
         SHOW BINARY LOG
            STATUS
        </code>
       </a>
       ,
       <a class="link" href="show-replica-status.html" title="15.7.7.35 SHOW REPLICA STATUS Statement">
        <code class="literal">
         SHOW REPLICA
            STATUS
        </code>
       </a>
       , and
       <a class="link" href="show-binary-logs.html" title="15.7.7.2 SHOW BINARY LOGS Statement">
        <code class="literal">
         SHOW BINARY
            LOGS
        </code>
       </a>
       statements.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_replication-slave">
       </a>
       <a class="link" href="privileges-provided.html#priv_replication-slave">
        <code class="literal">
         REPLICATION SLAVE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251597712">
      </a>
      <a class="indexterm" name="idm46045251596224">
      </a>
      <p>
       Enables the account to request updates that have been made
            to databases on the replication source server, using the
       <a class="link" href="show-replicas.html" title="15.7.7.36 SHOW REPLICAS Statement">
        <code class="literal">
         SHOW
            REPLICAS
        </code>
       </a>
       ,
       <a class="link" href="show-relaylog-events.html" title="15.7.7.34 SHOW RELAYLOG EVENTS Statement">
        <code class="literal">
         SHOW RELAYLOG
            EVENTS
        </code>
       </a>
       , and
       <a class="link" href="show-binlog-events.html" title="15.7.7.3 SHOW BINLOG EVENTS Statement">
        <code class="literal">
         SHOW BINLOG
            EVENTS
        </code>
       </a>
       statements. This privilege is also required
            to use the
       <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
        <span class="command">
         <strong>
          mysqlbinlog
         </strong>
        </span>
       </a>
       options
       <a class="link" href="mysqlbinlog.html#option_mysqlbinlog_read-from-remote-server">
        <code class="option">
         --read-from-remote-server
        </code>
       </a>
       (
       <code class="option">
        -R
       </code>
       ) and
       <a class="link" href="mysqlbinlog.html#option_mysqlbinlog_read-from-remote-source">
        <code class="option">
         --read-from-remote-source
        </code>
       </a>
       .
            Grant this privilege to accounts that are used by replicas
            to connect to the current server as their replication source
            server.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_select">
       </a>
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251584528">
      </a>
      <a class="indexterm" name="idm46045251583040">
      </a>
      <p>
       Enables rows to be selected from tables in a database.
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statements require the
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
       privilege only if they
            actually access tables. Some
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       statements do not
            access tables and can be executed without permission for any
            database. For example, you can use
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       as a simple calculator
            to evaluate expressions that make no reference to tables:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa4210818"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> <span class="token number">1</span><span class="token operator">+</span><span class="token number">1</span><span class="token punctuation">;</span>
<span class="token keyword">SELECT</span> <span class="token function">PI</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token operator">*</span><span class="token number">2</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
       privilege is also
            needed for other statements that read column values. For
            example,
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
       is needed for
            columns referenced on the right hand side of
       <em class="replaceable">
        <code>
         col_name
        </code>
       </em>
       =
       <em class="replaceable">
        <code>
         expr
        </code>
       </em>
       assignment in
       <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
        <code class="literal">
         UPDATE
        </code>
       </a>
       statements or for columns named in the
       <code class="literal">
        WHERE
       </code>
       clause of
       <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
        <code class="literal">
         DELETE
        </code>
       </a>
       or
       <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
        <code class="literal">
         UPDATE
        </code>
       </a>
       statements.
      </p>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
       privilege is
            needed for tables or views used with
       <a class="link" href="explain.html" title="15.8.2 EXPLAIN Statement">
        <code class="literal">
         EXPLAIN
        </code>
       </a>
       , including any
            underlying tables in view definitions.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_show-databases">
       </a>
       <a class="link" href="privileges-provided.html#priv_show-databases">
        <code class="literal">
         SHOW DATABASES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251561584">
      </a>
      <a class="indexterm" name="idm46045251560096">
      </a>
      <p>
       Enables the account to see database names by issuing the
       <code class="literal">
        SHOW DATABASE
       </code>
       statement. Accounts that do
            not have this privilege see only databases for which they
            have some privileges, and cannot use the statement at all if
            the server was started with the
       <a class="link" href="server-options.html#option_mysqld_skip-show-database">
        <code class="option">
         --skip-show-database
        </code>
       </a>
       option.
      </p>
      <div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Caution
       </div>
       <p>
        Because any static global privilege is considered a
              privilege for all databases, any static global privilege
              enables a user to see all database names with
        <a class="link" href="show-databases.html" title="15.7.7.15 SHOW DATABASES Statement">
         <code class="literal">
          SHOW DATABASES
         </code>
        </a>
        or by
              examining the
        <a class="link" href="information-schema-schemata-table.html" title="28.3.31 The INFORMATION_SCHEMA SCHEMATA Table">
         <code class="literal">
          SCHEMATA
         </code>
        </a>
        table
              of
        <code class="literal">
         INFORMATION_SCHEMA
        </code>
        , except databases
              that have been restricted at the database level by partial
              revokes.
       </p>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_show-view">
       </a>
       <a class="link" href="privileges-provided.html#priv_show-view">
        <code class="literal">
         SHOW VIEW
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251549920">
      </a>
      <a class="indexterm" name="idm46045251548432">
      </a>
      <p>
       Enables use of the
       <a class="link" href="show-create-view.html" title="15.7.7.14 SHOW CREATE VIEW Statement">
        <code class="literal">
         SHOW CREATE
            VIEW
        </code>
       </a>
       statement. This privilege is also needed for
            views used with
       <a class="link" href="explain.html" title="15.8.2 EXPLAIN Statement">
        <code class="literal">
         EXPLAIN
        </code>
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_shutdown">
       </a>
       <a class="link" href="privileges-provided.html#priv_shutdown">
        <code class="literal">
         SHUTDOWN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251541984">
      </a>
      <a class="indexterm" name="idm46045251540496">
      </a>
      <p>
       Enables use of the
       <a class="link" href="shutdown.html" title="15.7.8.9 SHUTDOWN Statement">
        <code class="literal">
         SHUTDOWN
        </code>
       </a>
       and
       <a class="link" href="restart.html" title="15.7.8.8 RESTART Statement">
        <code class="literal">
         RESTART
        </code>
       </a>
       statements, the
       <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
        <span class="command">
         <strong>
          mysqladmin shutdown
         </strong>
        </span>
       </a>
       command, and the
       <a class="ulink" href="/doc/c-api/8.4/en/mysql-shutdown.html" target="_top">
        <code class="literal">
         mysql_shutdown()
        </code>
       </a>
       C API
            function.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_super">
       </a>
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251531680">
      </a>
      <a class="indexterm" name="idm46045251530192">
      </a>
      <p>
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       is a powerful and
            far-reaching privilege and should not be granted lightly. If
            an account needs to perform only a subset of
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       operations, it may be
            possible to achieve the desired privilege set by instead
            granting one or more dynamic privileges, each of which
            confers more limited capabilities. See
       <a class="xref" href="privileges-provided.html#privileges-provided-dynamic" title="Dynamic Privilege Descriptions">
        Dynamic Privilege Descriptions
       </a>
       .
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        <a class="link" href="privileges-provided.html#priv_super">
         <code class="literal">
          SUPER
         </code>
        </a>
        is deprecated, and
              you should expect it to be removed in a future version of
              MySQL. See
        <a class="xref" href="privileges-provided.html#dynamic-privileges-migration-from-super" title="Migrating Accounts from SUPER to Dynamic Privileges">
         Migrating Accounts from SUPER to Dynamic Privileges
        </a>
        .
       </p>
      </div>
      <p>
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       affects the following
            operations and server behaviors:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Enables system variable changes at runtime:
         </p>
         <div class="itemizedlist">
          <ul class="itemizedlist" style="list-style-type: square; ">
           <li class="listitem">
            <p>
             Enables server configuration changes to global
                    system variables with
             <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
              <code class="literal">
               SET
                    GLOBAL
              </code>
             </a>
             and
             <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
              <code class="literal">
               SET
                    PERSIST
              </code>
             </a>
             .
            </p>
            <p>
             The corresponding dynamic privilege is
             <a class="link" href="privileges-provided.html#priv_system-variables-admin">
              <code class="literal">
               SYSTEM_VARIABLES_ADMIN
              </code>
             </a>
             .
            </p>
           </li>
           <li class="listitem">
            <p>
             Enables setting restricted session system variables
                    that require a special privilege.
            </p>
            <p>
             The corresponding dynamic privilege is
             <a class="link" href="privileges-provided.html#priv_session-variables-admin">
              <code class="literal">
               SESSION_VARIABLES_ADMIN
              </code>
             </a>
             .
            </p>
           </li>
          </ul>
         </div>
         <p>
          See also
          <a class="xref" href="system-variable-privileges.html" title="7.1.9.1 System Variable Privileges">
           Section 7.1.9.1, “System Variable Privileges”
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables changes to global transaction characteristics
                (see
          <a class="xref" href="set-transaction.html" title="15.3.7 SET TRANSACTION Statement">
           Section 15.3.7, “SET TRANSACTION Statement”
          </a>
          ).
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_system-variables-admin">
           <code class="literal">
            SYSTEM_VARIABLES_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables the account to start and stop replication,
                including Group Replication.
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_replication-slave-admin">
           <code class="literal">
            REPLICATION_SLAVE_ADMIN
           </code>
          </a>
          for regular replication,
          <a class="link" href="privileges-provided.html#priv_group-replication-admin">
           <code class="literal">
            GROUP_REPLICATION_ADMIN
           </code>
          </a>
          for Group Replication.
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables use of
          <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
           <code class="literal">
            CHANGE REPLICATION
                SOURCE TO
           </code>
          </a>
          and
          <a class="link" href="change-replication-filter.html" title="15.4.2.1 CHANGE REPLICATION FILTER Statement">
           <code class="literal">
            CHANGE
                REPLICATION FILTER
           </code>
          </a>
          statements.
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_replication-slave-admin">
           <code class="literal">
            REPLICATION_SLAVE_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables binary log control by means of the
          <a class="link" href="purge-binary-logs.html" title="15.4.1.1 PURGE BINARY LOGS Statement">
           <code class="literal">
            PURGE BINARY LOGS
           </code>
          </a>
          and
          <a class="link" href="binlog.html" title="15.7.8.1 BINLOG Statement">
           <code class="literal">
            BINLOG
           </code>
          </a>
          statements.
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_binlog-admin">
           <code class="literal">
            BINLOG_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables setting the effective authorization ID when
                executing a view or stored program. A user with this
                privilege can specify any account in the
          <code class="literal">
           DEFINER
          </code>
          attribute of a view or stored
                program.
         </p>
         <p>
          The corresponding dynamic privileges are
          <a class="link" href="privileges-provided.html#priv_set-any-definer">
           <code class="literal">
            SET_ANY_DEFINER
           </code>
          </a>
          and
          <a class="link" href="privileges-provided.html#priv_allow-nonexistent-definer">
           <code class="literal">
            ALLOW_NONEXISTENT_DEFINER
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables use of the
          <a class="link" href="create-server.html" title="15.1.18 CREATE SERVER Statement">
           <code class="literal">
            CREATE
                SERVER
           </code>
          </a>
          ,
          <a class="link" href="alter-server.html" title="15.1.8 ALTER SERVER Statement">
           <code class="literal">
            ALTER
                SERVER
           </code>
          </a>
          , and
          <a class="link" href="drop-server.html" title="15.1.30 DROP SERVER Statement">
           <code class="literal">
            DROP
                SERVER
           </code>
          </a>
          statements.
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables use of the
          <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
           <span class="command">
            <strong>
             mysqladmin debug
            </strong>
           </span>
          </a>
          command.
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables
          <code class="literal">
           InnoDB
          </code>
          encryption key
                rotation.
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_encryption-key-admin">
           <code class="literal">
            ENCRYPTION_KEY_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables execution of Version Tokens functions.
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_version-token-admin">
           <code class="literal">
            VERSION_TOKEN_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables granting and revoking roles, use of the
          <code class="literal">
           WITH ADMIN OPTION
          </code>
          clause of the
          <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
           <code class="literal">
            GRANT
           </code>
          </a>
          statement, and
                nonempty
          <code class="literal">
           &lt;graphml&gt;
          </code>
          element
                content in the result from the
          <a class="link" href="information-functions.html#function_roles-graphml">
           <code class="literal">
            ROLES_GRAPHML()
           </code>
          </a>
          function.
         </p>
         <p>
          The corresponding dynamic privilege is
          <a class="link" href="privileges-provided.html#priv_role-admin">
           <code class="literal">
            ROLE_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables control over client connections not permitted to
                non-
          <a class="link" href="privileges-provided.html#priv_super">
           <code class="literal">
            SUPER
           </code>
          </a>
          accounts:
         </p>
         <div class="itemizedlist">
          <ul class="itemizedlist" style="list-style-type: square; ">
           <li class="listitem">
            <p>
             Enables use of the
             <a class="link" href="kill.html" title="15.7.8.4 KILL Statement">
              <code class="literal">
               KILL
              </code>
             </a>
             statement or
             <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
              <span class="command">
               <strong>
                mysqladmin kill
               </strong>
              </span>
             </a>
             command to kill
                    threads belonging to other accounts. (An account can
                    always kill its own threads.)
            </p>
           </li>
           <li class="listitem">
            <p>
             The server does not execute
             <a class="link" href="server-system-variables.html#sysvar_init_connect">
              <code class="literal">
               init_connect
              </code>
             </a>
             system
                    variable content when
             <a class="link" href="privileges-provided.html#priv_super">
              <code class="literal">
               SUPER
              </code>
             </a>
             clients
                    connect.
            </p>
           </li>
           <li class="listitem">
            <p>
             The server accepts one connection from a
             <a class="link" href="privileges-provided.html#priv_super">
              <code class="literal">
               SUPER
              </code>
             </a>
             client even if
                    the connection limit configured by the
             <a class="link" href="server-system-variables.html#sysvar_max_connections">
              <code class="literal">
               max_connections
              </code>
             </a>
             system variable is reached.
            </p>
           </li>
           <li class="listitem">
            <p>
             A server in offline mode
                    (
             <a class="link" href="server-system-variables.html#sysvar_offline_mode">
              <code class="literal">
               offline_mode
              </code>
             </a>
             enabled) does not terminate
             <a class="link" href="privileges-provided.html#priv_super">
              <code class="literal">
               SUPER
              </code>
             </a>
             client
                    connections at the next client request, and accepts
                    new connections from
             <a class="link" href="privileges-provided.html#priv_super">
              <code class="literal">
               SUPER
              </code>
             </a>
             clients.
            </p>
           </li>
           <li class="listitem">
            <p>
             Updates can be performed even when the
             <a class="link" href="server-system-variables.html#sysvar_read_only">
              <code class="literal">
               read_only
              </code>
             </a>
             system
                    variable is enabled. This applies to explicit table
                    updates, and to use of account-management statements
                    such as
             <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
              <code class="literal">
               GRANT
              </code>
             </a>
             and
             <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
              <code class="literal">
               REVOKE
              </code>
             </a>
             that update
                    tables implicitly.
            </p>
           </li>
          </ul>
         </div>
         <p>
          The corresponding dynamic privilege for the preceding
                connection-control operations is
          <a class="link" href="privileges-provided.html#priv_connection-admin">
           <code class="literal">
            CONNECTION_ADMIN
           </code>
          </a>
          .
         </p>
        </li>
       </ul>
      </div>
      <p>
       You may also need the
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privilege to create or alter stored functions if binary
            logging is enabled, as described in
       <a class="xref" href="stored-programs-logging.html" title="27.7 Stored Program Binary Logging">
        Section 27.7, “Stored Program Binary Logging”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_trigger">
       </a>
       <a class="link" href="privileges-provided.html#priv_trigger">
        <code class="literal">
         TRIGGER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251437248">
      </a>
      <a class="indexterm" name="idm46045251435760">
      </a>
      <p>
       Enables trigger operations. You must have this privilege for
            a table to create, drop, execute, or display triggers for
            that table.
      </p>
      <p>
       When a trigger is activated (by a user who has privileges to
            execute
       <a class="link" href="insert.html" title="15.2.7 INSERT Statement">
        <code class="literal">
         INSERT
        </code>
       </a>
       ,
       <a class="link" href="update.html" title="15.2.17 UPDATE Statement">
        <code class="literal">
         UPDATE
        </code>
       </a>
       , or
       <a class="link" href="delete.html" title="15.2.2 DELETE Statement">
        <code class="literal">
         DELETE
        </code>
       </a>
       statements for the
            table associated with the trigger), trigger execution
            requires that the user who defined the trigger still have
            the
       <a class="link" href="privileges-provided.html#priv_trigger">
        <code class="literal">
         TRIGGER
        </code>
       </a>
       privilege for the
            table.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_update">
       </a>
       <a class="link" href="privileges-provided.html#priv_update">
        <code class="literal">
         UPDATE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251426096">
      </a>
      <a class="indexterm" name="idm46045251424608">
      </a>
      <p>
       Enables rows to be updated in tables in a database.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_usage">
       </a>
       <a class="link" href="privileges-provided.html#priv_usage">
        <code class="literal">
         USAGE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251420656">
      </a>
      <a class="indexterm" name="idm46045251419168">
      </a>
      <p>
       This privilege specifier stands for
       <span class="quote">
        “
        <span class="quote">
         no
            privileges.
        </span>
        ”
       </span>
       It is used at the global level with
       <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
        <code class="literal">
         GRANT
        </code>
       </a>
       to specify clauses such
            as
       <code class="literal">
        WITH GRANT OPTION
       </code>
       without naming
            specific account privileges in the privilege list.
       <a class="link" href="show-grants.html" title="15.7.7.22 SHOW GRANTS Statement">
        <code class="literal">
         SHOW GRANTS
        </code>
       </a>
       displays
       <a class="link" href="privileges-provided.html#priv_usage">
        <code class="literal">
         USAGE
        </code>
       </a>
       to indicate that an
            account has no privileges at a privilege level.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="privileges-provided-dynamic">
       </a>
       Dynamic Privilege Descriptions
      </h4>
     </div>
    </div>
   </div>
   <p>
    Dynamic privileges are defined at runtime, in contrast to static
        privileges, which are built in to the server. The following list
        describes each dynamic privilege available in MySQL.
   </p>
   <p>
    Most dynamic privileges are defined at server startup. Others
        are defined by a particular component or plugin, as indicated in
        the privilege descriptions. In such cases, the privilege is
        unavailable unless the component or plugin that defines it is
        enabled.
   </p>
   <p>
    Particular SQL statements might have more specific privilege
        requirements than indicated here. If so, the description for the
        statement in question provides the details.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a name="priv_allow-nonexistent-definer">
       </a>
       <a class="link" href="privileges-provided.html#priv_allow-nonexistent-definer">
        <code class="literal">
         ALLOW_NONEXISTENT_DEFINER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251406544">
      </a>
      <a class="indexterm" name="idm46045251405040">
      </a>
      <p>
       Enables overriding security checks designed to prevent
            operations that (perhaps inadvertently) cause stored objects
            to become orphaned or that cause adoption of stored objects
            that are currently orphaned. Without this privilege, any
            attempt to produce an orphaned SQL procedure, function, or
            view results in an error. An attempt to produce orphaned
            objects using
       <a class="link" href="create-procedure.html" title="15.1.17 CREATE PROCEDURE and CREATE FUNCTION Statements">
        <code class="literal">
         CREATE
            PROCEDURE
        </code>
       </a>
       ,
       <a class="link" href="create-function.html" title="15.1.14 CREATE FUNCTION Statement">
        <code class="literal">
         CREATE
            FUNCTION
        </code>
       </a>
       ,
       <a class="link" href="create-trigger.html" title="15.1.22 CREATE TRIGGER Statement">
        <code class="literal">
         CREATE
            TRIGGER
        </code>
       </a>
       ,
       <a class="link" href="create-event.html" title="15.1.13 CREATE EVENT Statement">
        <code class="literal">
         CREATE
            EVENT
        </code>
       </a>
       , or
       <a class="link" href="create-view.html" title="15.1.23 CREATE VIEW Statement">
        <code class="literal">
         CREATE
            VIEW
        </code>
       </a>
       also requires
       <a class="link" href="privileges-provided.html#priv_set-any-definer">
        <code class="literal">
         SET_ANY_DEFINER
        </code>
       </a>
       in addition
            to
       <a class="link" href="privileges-provided.html#priv_allow-nonexistent-definer">
        <code class="literal">
         ALLOW_NONEXISTENT_DEFINER
        </code>
       </a>
       ,
            so that a definer different from the current user is
            permissible.
      </p>
      <p>
       For details, see
       <a class="xref" href="stored-objects-security.html#stored-objects-security-orphan-objects" title="Orphan Stored Objects">
        Orphan Stored Objects
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_application-password-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_application-password-admin">
        <code class="literal">
         APPLICATION_PASSWORD_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251390544">
      </a>
      <a class="indexterm" name="idm46045251389040">
      </a>
      <p>
       For dual-password capability, this privilege enables use of
            the
       <code class="literal">
        RETAIN CURRENT PASSWORD
       </code>
       and
       <code class="literal">
        DISCARD OLD PASSWORD
       </code>
       clauses for
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       and
       <a class="link" href="set-password.html" title="15.7.1.10 SET PASSWORD Statement">
        <code class="literal">
         SET PASSWORD
        </code>
       </a>
       statements that
            apply to your own account. This privilege is required to
            manipulate your own secondary password because most users
            require only one password.
      </p>
      <p>
       If an account is to be permitted to manipulate secondary
            passwords for all accounts, it should be granted the
       <a class="link" href="privileges-provided.html#priv_create-user">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       privilege rather
            than
       <a class="link" href="privileges-provided.html#priv_application-password-admin">
        <code class="literal">
         APPLICATION_PASSWORD_ADMIN
        </code>
       </a>
       .
      </p>
      <p>
       For more information about use of dual passwords, see
       <a class="xref" href="password-management.html" title="8.2.15 Password Management">
        Section 8.2.15, “Password Management”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_audit-abort-exempt">
       </a>
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251376704">
      </a>
      <a class="indexterm" name="idm46045251375216">
      </a>
      <p>
       Allows queries blocked by an
       <span class="quote">
        “
        <span class="quote">
         abort
        </span>
        ”
       </span>
       item in
            the audit log filter. This privilege is defined by the
       <code class="literal">
        audit_log
       </code>
       plugin; see
       <a class="xref" href="audit-log.html" title="8.4.5 MySQL Enterprise Audit">
        Section 8.4.5, “MySQL Enterprise Audit”
       </a>
       .
      </p>
      <p>
       Accounts created with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege have
            the
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
       privilege assigned automatically when they are created. The
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
       privilege
            is also assigned to existing accounts with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege when you carry out an upgrade procedure, if no
            existing accounts have that privilege assigned. Accounts
            with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege can therefore be used to regain access to a system
            following an audit misconfiguration.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_audit-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_audit-admin">
        <code class="literal">
         AUDIT_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251362400">
      </a>
      <a class="indexterm" name="idm46045251360912">
      </a>
      <p>
       Enables audit log configuration. This privilege is defined
            by the
       <code class="literal">
        audit_log
       </code>
       plugin; see
       <a class="xref" href="audit-log.html" title="8.4.5 MySQL Enterprise Audit">
        Section 8.4.5, “MySQL Enterprise Audit”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_backup-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_backup-admin">
        <code class="literal">
         BACKUP_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251355600">
      </a>
      <a class="indexterm" name="idm46045251354112">
      </a>
      <p>
       Enables execution of the
       <a class="link" href="lock-instance-for-backup.html" title="15.3.5 LOCK INSTANCE FOR BACKUP and UNLOCK INSTANCE Statements">
        <code class="literal">
         LOCK INSTANCE
            FOR BACKUP
        </code>
       </a>
       statement and access to the Performance
            Schema
       <a class="link" href="performance-schema-log-status-table.html" title="29.12.22.5 The log_status Table">
        <code class="literal">
         log_status
        </code>
       </a>
       table.
      </p>
      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
       <div class="admon-title">
        Note
       </div>
       <p>
        Besides
        <a class="link" href="privileges-provided.html#priv_backup-admin">
         <code class="literal">
          BACKUP_ADMIN
         </code>
        </a>
        , the
        <a class="link" href="privileges-provided.html#priv_select">
         <code class="literal">
          SELECT
         </code>
        </a>
        privilege on the
        <a class="link" href="performance-schema-log-status-table.html" title="29.12.22.5 The log_status Table">
         <code class="literal">
          log_status
         </code>
        </a>
        table is also
              needed for its access.
       </p>
      </div>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_backup-admin">
        <code class="literal">
         BACKUP_ADMIN
        </code>
       </a>
       privilege is
            automatically granted to users with the
       <a class="link" href="privileges-provided.html#priv_reload">
        <code class="literal">
         RELOAD
        </code>
       </a>
       privilege when
            performing an in-place upgrade to MySQL 8.4
            from an earlier version.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_authentication-policy-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
        <code class="literal">
         AUTHENTICATION_POLICY_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251339728">
      </a>
      <a class="indexterm" name="idm46045251338224">
      </a>
      <p>
       The
       <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
        <code class="literal">
         authentication_policy
        </code>
       </a>
       system variable places certain constraints on how the
            authentication-related clauses of
       <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
        <code class="literal">
         CREATE USER
        </code>
       </a>
       and
       <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
        <code class="literal">
         ALTER USER
        </code>
       </a>
       statements may be
            used. A user who has the
       <a class="link" href="privileges-provided.html#priv_authentication-policy-admin">
        <code class="literal">
         AUTHENTICATION_POLICY_ADMIN
        </code>
       </a>
       privilege is not subject to these constraints. (A warning
            does occur for statements that otherwise would not be
            permitted.)
      </p>
      <p>
       For details about the constraints imposed by
       <a class="link" href="server-system-variables.html#sysvar_authentication_policy">
        <code class="literal">
         authentication_policy
        </code>
       </a>
       , see
            the description of that variable.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_binlog-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_binlog-admin">
        <code class="literal">
         BINLOG_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251327216">
      </a>
      <a class="indexterm" name="idm46045251325728">
      </a>
      <p>
       Enables binary log control by means of the
       <a class="link" href="purge-binary-logs.html" title="15.4.1.1 PURGE BINARY LOGS Statement">
        <code class="literal">
         PURGE BINARY LOGS
        </code>
       </a>
       and
       <a class="link" href="binlog.html" title="15.7.8.1 BINLOG Statement">
        <code class="literal">
         BINLOG
        </code>
       </a>
       statements.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_binlog-encryption-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_binlog-encryption-admin">
        <code class="literal">
         BINLOG_ENCRYPTION_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251319216">
      </a>
      <a class="indexterm" name="idm46045251317728">
      </a>
      <p>
       Enables setting the system variable
       <a class="link" href="replication-options-binary-log.html#sysvar_binlog_encryption">
        <code class="literal">
         binlog_encryption
        </code>
       </a>
       , which
            activates or deactivates encryption for binary log files and
            relay log files. This ability is not provided by the
       <a class="link" href="privileges-provided.html#priv_binlog-admin">
        <code class="literal">
         BINLOG_ADMIN
        </code>
       </a>
       ,
       <a class="link" href="privileges-provided.html#priv_system-variables-admin">
        <code class="literal">
         SYSTEM_VARIABLES_ADMIN
        </code>
       </a>
       , or
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
       privileges. The related system variable
       <a class="link" href="replication-options-binary-log.html#sysvar_binlog_rotate_encryption_master_key_at_startup">
        <code class="literal">
         binlog_rotate_encryption_master_key_at_startup
        </code>
       </a>
       ,
            which rotates the binary log master key automatically when
            the server is restarted, does not require this privilege.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_clone-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_clone-admin">
        <code class="literal">
         CLONE_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251307200">
      </a>
      <a class="indexterm" name="idm46045251305712">
      </a>
      <p>
       Enables execution of the
       <code class="literal">
        CLONE
       </code>
       statements. Includes
       <a class="link" href="privileges-provided.html#priv_backup-admin">
        <code class="literal">
         BACKUP_ADMIN
        </code>
       </a>
       and
       <a class="link" href="privileges-provided.html#priv_shutdown">
        <code class="literal">
         SHUTDOWN
        </code>
       </a>
       privileges.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_connection-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_connection-admin">
        <code class="literal">
         CONNECTION_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251298592">
      </a>
      <a class="indexterm" name="idm46045251297104">
      </a>
      <p>
       Enables use of the
       <a class="link" href="kill.html" title="15.7.8.4 KILL Statement">
        <code class="literal">
         KILL
        </code>
       </a>
       statement or
       <a class="link" href="mysqladmin.html" title="6.5.2 mysqladmin — A MySQL Server Administration Program">
        <span class="command">
         <strong>
          mysqladmin kill
         </strong>
        </span>
       </a>
       command to
            kill threads belonging to other accounts. (An account can
            always kill its own threads.)
      </p>
      <p>
       Enables setting system variables related to client
            connections, or circumventing restrictions related to client
            connections.
       <a class="link" href="privileges-provided.html#priv_connection-admin">
        <code class="literal">
         CONNECTION_ADMIN
        </code>
       </a>
       is required to activate MySQL Server’s offline mode, which
            is done by changing the value of the
       <a class="link" href="server-system-variables.html#sysvar_offline_mode">
        <code class="literal">
         offline_mode
        </code>
       </a>
       system
            variable to
       <code class="literal">
        ON
       </code>
       .
      </p>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_connection-admin">
        <code class="literal">
         CONNECTION_ADMIN
        </code>
       </a>
       privilege enables administrators with it to bypass effects
            of these system variables:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          <a class="link" href="server-system-variables.html#sysvar_init_connect">
           <code class="literal">
            init_connect
           </code>
          </a>
          : The
                server does not execute
          <a class="link" href="server-system-variables.html#sysvar_init_connect">
           <code class="literal">
            init_connect
           </code>
          </a>
          system
                variable content when
          <a class="link" href="privileges-provided.html#priv_connection-admin">
           <code class="literal">
            CONNECTION_ADMIN
           </code>
          </a>
          clients
                connect.
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="server-system-variables.html#sysvar_max_connections">
           <code class="literal">
            max_connections
           </code>
          </a>
          : The
                server accepts one connection from a
          <a class="link" href="privileges-provided.html#priv_connection-admin">
           <code class="literal">
            CONNECTION_ADMIN
           </code>
          </a>
          client
                even if the connection limit configured by the
          <a class="link" href="server-system-variables.html#sysvar_max_connections">
           <code class="literal">
            max_connections
           </code>
          </a>
          system
                variable is reached.
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="server-system-variables.html#sysvar_offline_mode">
           <code class="literal">
            offline_mode
           </code>
          </a>
          : A server
                in offline mode
                (
          <a class="link" href="server-system-variables.html#sysvar_offline_mode">
           <code class="literal">
            offline_mode
           </code>
          </a>
          enabled)
                does not terminate
          <a class="link" href="privileges-provided.html#priv_connection-admin">
           <code class="literal">
            CONNECTION_ADMIN
           </code>
          </a>
          client
                connections at the next client request, and accepts new
                connections from
          <a class="link" href="privileges-provided.html#priv_connection-admin">
           <code class="literal">
            CONNECTION_ADMIN
           </code>
          </a>
          clients.
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="server-system-variables.html#sysvar_read_only">
           <code class="literal">
            read_only
           </code>
          </a>
          : Updates from
          <a class="link" href="privileges-provided.html#priv_connection-admin">
           <code class="literal">
            CONNECTION_ADMIN
           </code>
          </a>
          clients
                can be performed even when the
          <a class="link" href="server-system-variables.html#sysvar_read_only">
           <code class="literal">
            read_only
           </code>
          </a>
          system
                variable is enabled. This applies to explicit table
                updates, and to account management statements such as
          <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
           <code class="literal">
            GRANT
           </code>
          </a>
          and
          <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
           <code class="literal">
            REVOKE
           </code>
          </a>
          that update tables
                implicitly.
         </p>
        </li>
       </ul>
      </div>
      <p>
       Group Replication group members need the
       <a class="link" href="privileges-provided.html#priv_connection-admin">
        <code class="literal">
         CONNECTION_ADMIN
        </code>
       </a>
       privilege so
            that Group Replication connections are not terminated if one
            of the servers involved is placed in offline mode. If the
            MySQL communication stack is in use
            (
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
        <code class="literal">
         group_replication_communication_stack
            = MYSQL
        </code>
       </a>
       ), without this privilege, a member that is
            placed in offline mode is expelled from the group.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_encryption-key-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_encryption-key-admin">
        <code class="literal">
         ENCRYPTION_KEY_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251255968">
      </a>
      <a class="indexterm" name="idm46045251254480">
      </a>
      <p>
       Enables
       <code class="literal">
        InnoDB
       </code>
       encryption key rotation.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_firewall-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_firewall-admin">
        <code class="literal">
         FIREWALL_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251249888">
      </a>
      <a class="indexterm" name="idm46045251248400">
      </a>
      <p>
       Enables a user to administer firewall rules for any user.
            This privilege is defined by the
       <code class="literal">
        MYSQL_FIREWALL
       </code>
       plugin; see
       <a class="xref" href="firewall.html" title="8.4.7 MySQL Enterprise Firewall">
        Section 8.4.7, “MySQL Enterprise Firewall”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_firewall-exempt">
       </a>
       <a class="link" href="privileges-provided.html#priv_firewall-exempt">
        <code class="literal">
         FIREWALL_EXEMPT
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251242976">
      </a>
      <a class="indexterm" name="idm46045251241488">
      </a>
      <p>
       A user with this privilege is exempt from firewall
            restrictions. This privilege is defined by the
       <code class="literal">
        MYSQL_FIREWALL
       </code>
       plugin; see
       <a class="xref" href="firewall.html" title="8.4.7 MySQL Enterprise Firewall">
        Section 8.4.7, “MySQL Enterprise Firewall”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_firewall-user">
       </a>
       <a class="link" href="privileges-provided.html#priv_firewall-user">
        <code class="literal">
         FIREWALL_USER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251236128">
      </a>
      <a class="indexterm" name="idm46045251234640">
      </a>
      <p>
       Enables users to update their own firewall rules. This
            privilege is defined by the
       <code class="literal">
        MYSQL_FIREWALL
       </code>
       plugin; see
       <a class="xref" href="firewall.html" title="8.4.7 MySQL Enterprise Firewall">
        Section 8.4.7, “MySQL Enterprise Firewall”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_flush-optimizer-costs">
       </a>
       <a class="link" href="privileges-provided.html#priv_flush-optimizer-costs">
        <code class="literal">
         FLUSH_OPTIMIZER_COSTS
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251229184">
      </a>
      <a class="indexterm" name="idm46045251227696">
      </a>
      <p>
       Enables use of the
       <a class="link" href="flush.html#flush-optimizer-costs">
        <code class="literal">
         FLUSH
            OPTIMIZER_COSTS
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_flush-privileges">
       </a>
       <a class="link" href="privileges-provided.html#priv_flush-privileges">
        <code class="literal">
         FLUSH_PRIVILEGES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251222464">
      </a>
      <a class="indexterm" name="idm46045251220976">
      </a>
      <p>
       Enables use of the
       <a class="link" href="flush.html#flush-privileges">
        <code class="literal">
         FLUSH
            PRIVILEGES
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_flush-status">
       </a>
       <a class="link" href="privileges-provided.html#priv_flush-status">
        <code class="literal">
         FLUSH_STATUS
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251215808">
      </a>
      <a class="indexterm" name="idm46045251214320">
      </a>
      <p>
       Enables use of the
       <a class="link" href="flush.html#flush-status">
        <code class="literal">
         FLUSH
            STATUS
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_flush-tables">
       </a>
       <a class="link" href="privileges-provided.html#priv_flush-tables">
        <code class="literal">
         FLUSH_TABLES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251209168">
      </a>
      <a class="indexterm" name="idm46045251207680">
      </a>
      <p>
       Enables use of the
       <a class="link" href="flush.html#flush-tables">
        <code class="literal">
         FLUSH
            TABLES
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_flush-user-resources">
       </a>
       <a class="link" href="privileges-provided.html#priv_flush-user-resources">
        <code class="literal">
         FLUSH_USER_RESOURCES
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251202416">
      </a>
      <a class="indexterm" name="idm46045251200928">
      </a>
      <p>
       Enables use of the
       <a class="link" href="flush.html#flush-user-resources">
        <code class="literal">
         FLUSH
            USER_RESOURCES
        </code>
       </a>
       statement.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_group-replication-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_group-replication-admin">
        <code class="literal">
         GROUP_REPLICATION_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251195568">
      </a>
      <a class="indexterm" name="idm46045251194080">
      </a>
      <p>
       Enables the account to start and stop Group Replication
            using the
       <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
        <code class="literal">
         START GROUP
            REPLICATION
        </code>
       </a>
       and
       <a class="link" href="stop-group-replication.html" title="15.4.3.2 STOP GROUP_REPLICATION Statement">
        <code class="literal">
         STOP GROUP
            REPLICATION
        </code>
       </a>
       statements, to change the global
            setting for the
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_consistency">
        <code class="literal">
         group_replication_consistency
        </code>
       </a>
       system variable, and to use the
       <a class="link" href="group-replication-functions-for-maximum-consensus.html#function_group-replication-set-write-concurrency">
        <code class="literal">
         group_replication_set_write_concurrency()
        </code>
       </a>
       and
       <a class="link" href="group-replication-functions-for-communication-protocol.html#function_group-replication-set-communication-protocol">
        <code class="literal">
         group_replication_set_communication_protocol()
        </code>
       </a>
       functions. Grant this privilege to accounts that are used to
            administer servers that are members of a replication group.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_group-replication-stream">
       </a>
       <a class="link" href="privileges-provided.html#priv_group-replication-stream">
        <code class="literal">
         GROUP_REPLICATION_STREAM
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251182960">
      </a>
      <a class="indexterm" name="idm46045251181456">
      </a>
      <p>
       Allows a user account to be used for establishing Group
            Replication's group communication connections. It must be
            granted to a recovery user when the MySQL communication
            stack is used for Group Replication
            (
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
        <code class="literal">
         group_replication_communication_stack=MYSQL
        </code>
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_innodb-redo-log-archive">
       </a>
       <a class="link" href="privileges-provided.html#priv_innodb-redo-log-archive">
        <code class="literal">
         INNODB_REDO_LOG_ARCHIVE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251175856">
      </a>
      <a class="indexterm" name="idm46045251174368">
      </a>
      <p>
       Enables the account to activate and deactivate redo log
            archiving.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_innodb-redo-log-enable">
       </a>
       <a class="link" href="privileges-provided.html#priv_innodb-redo-log-enable">
        <code class="literal">
         INNODB_REDO_LOG_ENABLE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251170384">
      </a>
      <a class="indexterm" name="idm46045251168896">
      </a>
      <p>
       Enables use of the
       <a class="link" href="alter-instance.html" title="15.1.5 ALTER INSTANCE Statement">
        <code class="literal">
         ALTER
            INSTANCE {ENABLE|DISABLE} INNODB REDO_LOG
        </code>
       </a>
       statement to enable or disable redo logging.
      </p>
      <p>
       See
       <a class="xref" href="innodb-redo-log.html#innodb-disable-redo-logging" title="Disabling Redo Logging">
        Disabling Redo Logging
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_masking-dictionaries-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_masking-dictionaries-admin">
        <code class="literal">
         MASKING_DICTIONARIES_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251162480">
      </a>
      <a class="indexterm" name="idm46045251160976">
      </a>
      <p>
       Enables the account to add and remove dictionary terms using
            the
       <a class="link" href="data-masking-component-functions.html#function_masking-dictionary-term-add">
        <code class="literal">
         masking_dictionary_term_add()
        </code>
       </a>
       and
       <a class="link" href="data-masking-component-functions.html#function_masking-dictionary-term-remove">
        <code class="literal">
         masking_dictionary_term_remove()
        </code>
       </a>
       component functions. Accounts also require this dynamic
            privilege to remove a full dictionary using the
       <a class="link" href="data-masking-component-functions.html#function_masking-dictionary-remove">
        <code class="literal">
         masking_dictionary_remove()
        </code>
       </a>
       function, which removes all of the terms associated with the
            named dictionary currently in the
       <code class="literal">
        mysql.masking_dictionaries
       </code>
       table.
      </p>
      <p>
       See
       <a class="xref" href="data-masking.html" title="8.5 MySQL Enterprise Data Masking and De-Identification">
        Section 8.5, “MySQL Enterprise Data Masking and De-Identification”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_ndb-stored-user">
       </a>
       <a class="link" href="privileges-provided.html#priv_ndb-stored-user">
        <code class="literal">
         NDB_STORED_USER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251150592">
      </a>
      <a class="indexterm" name="idm46045251149104">
      </a>
      <p>
       Enables the user or role and its privileges to be shared and
            synchronized between all
       <code class="literal">
        NDB
       </code>
       -enabled
            MySQL servers as soon as they join a given NDB Cluster. This
            privilege is available only if the
       <a class="link" href="mysql-cluster.html" title="Chapter 25 MySQL NDB Cluster 8.4">
        <code class="literal">
         NDB
        </code>
       </a>
       storage engine is enabled.
      </p>
      <p>
       Any changes to or revocations of privileges made for the
            given user or role are synchronized immediately with all
            connected MySQL servers (SQL nodes). You should be aware
            that there is no guarantee that multiple statements
            affecting privileges originating from different SQL nodes
            are executed on all SQL nodes in the same order. For this
            reason, it is highly recommended that all user
            administration be done from a single designated SQL node.
      </p>
      <p>
       <code class="literal">
        NDB_STORED_USER
       </code>
       is a global privilege and
            must be granted or revoked using
       <code class="literal">
        ON *.*
       </code>
       .
            Trying to set any other scope for this privilege results in
            an error. This privilege can be given to most application
            and administrative users, but it cannot be granted to system
            reserved accounts such as
       <code class="literal">
        mysql.session@localhost
       </code>
       or
       <code class="literal">
        mysql.infoschema@localhost
       </code>
       .
      </p>
      <p>
       A user that has been granted the
       <code class="literal">
        NDB_STORED_USER
       </code>
       privilege is stored in
       <code class="literal">
        NDB
       </code>
       (and thus shared by all SQL nodes),
            as is a role with this privilege. A user that is merely
            granted a role that has
       <code class="literal">
        NDB_STORED_USER
       </code>
       is
       <span class="emphasis">
        <em>
         not
        </em>
       </span>
       stored in
       <code class="literal">
        NDB
       </code>
       ; each
       <code class="literal">
        NDB
       </code>
       stored
            user must be granted the privilege explicitly.
      </p>
      <p>
       For more detailed information about how this works in
       <a class="link" href="mysql-cluster.html" title="Chapter 25 MySQL NDB Cluster 8.4">
        <code class="literal">
         NDB
        </code>
       </a>
       , see
       <a class="xref" href="mysql-cluster-privilege-synchronization.html" title="25.6.13 Privilege Synchronization and NDB_STORED_USER">
        Section 25.6.13, “Privilege Synchronization and NDB_STORED_USER”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_optimize-local-table">
       </a>
       <a class="link" href="privileges-provided.html#priv_optimize-local-table">
        <code class="literal">
         OPTIMIZE_LOCAL_TABLE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251131280">
      </a>
      <a class="indexterm" name="idm46045251129792">
      </a>
      <p>
       Enables use of
       <a class="link" href="optimize-table.html" title="15.7.3.4 OPTIMIZE TABLE Statement">
        <code class="literal">
         OPTIMIZE
            LOCAL TABLE
        </code>
       </a>
       and
       <a class="link" href="optimize-table.html" title="15.7.3.4 OPTIMIZE TABLE Statement">
        <code class="literal">
         OPTIMIZE
            NO_WRITE_TO_BINLOG TABLE
        </code>
       </a>
       statements.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_passwordless-user-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
        <code class="literal">
         PASSWORDLESS_USER_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251123280">
      </a>
      <a class="indexterm" name="idm46045251121792">
      </a>
      <p>
       This privilege applies to passwordless user accounts:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          For account creation, a user who executes
          <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
           <code class="literal">
            CREATE USER
           </code>
          </a>
          to create a
                passwordless account must possess the
          <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
           <code class="literal">
            PASSWORDLESS_USER_ADMIN
           </code>
          </a>
          privilege.
         </p>
        </li>
        <li class="listitem">
         <p>
          In replication context, the
          <a class="link" href="privileges-provided.html#priv_passwordless-user-admin">
           <code class="literal">
            PASSWORDLESS_USER_ADMIN
           </code>
          </a>
          privilege applies to replication users and enables
                replication of
          <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
           <code class="literal">
            ALTER USER
                ... MODIFY
           </code>
          </a>
          statements for user accounts that
                are configured for passwordless authentication.
         </p>
        </li>
       </ul>
      </div>
      <p>
       For information about passwordless authentication, see
       <a class="xref" href="webauthn-pluggable-authentication.html#webauthn-pluggable-authentication-passwordless" title="WebAuthn Passwordless Authentication">
        WebAuthn Passwordless Authentication
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_persist-ro-variables-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_persist-ro-variables-admin">
        <code class="literal">
         PERSIST_RO_VARIABLES_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251109072">
      </a>
      <a class="indexterm" name="idm46045251107568">
      </a>
      <p>
       For users who also have
       <a class="link" href="privileges-provided.html#priv_system-variables-admin">
        <code class="literal">
         SYSTEM_VARIABLES_ADMIN
        </code>
       </a>
       ,
       <a class="link" href="privileges-provided.html#priv_persist-ro-variables-admin">
        <code class="literal">
         PERSIST_RO_VARIABLES_ADMIN
        </code>
       </a>
       enables use of
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
            PERSIST_ONLY
        </code>
       </a>
       to persist global system variables to
            the
       <code class="filename">
        mysqld-auto.cnf
       </code>
       option file in the
            data directory. This statement is similar to
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
            PERSIST
        </code>
       </a>
       but does not modify the runtime global
            system variable value. This makes
       <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
        <code class="literal">
         SET
            PERSIST_ONLY
        </code>
       </a>
       suitable for configuring read-only
            system variables that can be set only at server startup.
      </p>
      <p>
       See also
       <a class="xref" href="system-variable-privileges.html" title="7.1.9.1 System Variable Privileges">
        Section 7.1.9.1, “System Variable Privileges”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_replication-applier">
       </a>
       <a class="link" href="privileges-provided.html#priv_replication-applier">
        <code class="literal">
         REPLICATION_APPLIER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251095088">
      </a>
      <a class="indexterm" name="idm46045251093600">
      </a>
      <p>
       Enables the account to act as the
       <code class="literal">
        PRIVILEGE_CHECKS_USER
       </code>
       for a replication
            channel, and to execute
       <code class="literal">
        BINLOG
       </code>
       statements
            in
       <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
        <span class="command">
         <strong>
          mysqlbinlog
         </strong>
        </span>
       </a>
       output. Grant this
            privilege to accounts that are assigned using
       <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
        <code class="literal">
         CHANGE REPLICATION SOURCE TO
        </code>
       </a>
       to provide a security context for replication channels, and
            to handle replication errors on those channels. As well as
            the
       <code class="literal">
        REPLICATION_APPLIER
       </code>
       privilege, you
            must also give the account the required privileges to
            execute the transactions received by the replication channel
            or contained in the
       <a class="link" href="mysqlbinlog.html" title="6.6.9 mysqlbinlog — Utility for Processing Binary Log Files">
        <span class="command">
         <strong>
          mysqlbinlog
         </strong>
        </span>
       </a>
       output,
            for example to update the affected tables. For more
            information, see
       <a class="xref" href="replication-privilege-checks.html" title="19.3.3 Replication Privilege Checks">
        Section 19.3.3, “Replication Privilege Checks”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_replication-slave-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_replication-slave-admin">
        <code class="literal">
         REPLICATION_SLAVE_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251082496">
      </a>
      <a class="indexterm" name="idm46045251081008">
      </a>
      <p>
       Enables the account to connect to the replication source
            server, start and stop replication using the
       <a class="link" href="start-replica.html" title="15.4.2.4 START REPLICA Statement">
        <code class="literal">
         START REPLICA
        </code>
       </a>
       and
       <a class="link" href="stop-replica.html" title="15.4.2.5 STOP REPLICA Statement">
        <code class="literal">
         STOP REPLICA
        </code>
       </a>
       statements, and
            use the
       <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
        <code class="literal">
         CHANGE REPLICATION SOURCE
            TO
        </code>
       </a>
       and
       <a class="link" href="change-replication-filter.html" title="15.4.2.1 CHANGE REPLICATION FILTER Statement">
        <code class="literal">
         CHANGE REPLICATION
            FILTER
        </code>
       </a>
       statements. Grant this privilege to
            accounts that are used by replicas to connect to the current
            server as their replication source server. This privilege
            does not apply to Group Replication; use
       <code class="literal">
        GROUP_REPLICATION_ADMIN
       </code>
       for that.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_resource-group-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_resource-group-admin">
        <code class="literal">
         RESOURCE_GROUP_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251070976">
      </a>
      <a class="indexterm" name="idm46045251069488">
      </a>
      <p>
       Enables resource group management, consisting of creating,
            altering, and dropping resource groups, and assignment of
            threads and statements to resource groups. A user with this
            privilege can perform any operation relating to resource
            groups.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_resource-group-user">
       </a>
       <a class="link" href="privileges-provided.html#priv_resource-group-user">
        <code class="literal">
         RESOURCE_GROUP_USER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251065216">
      </a>
      <a class="indexterm" name="idm46045251063728">
      </a>
      <p>
       Enables assigning threads and statements to resource groups.
            A user with this privilege can use the
       <a class="link" href="set-resource-group.html" title="15.7.2.4 SET RESOURCE GROUP Statement">
        <code class="literal">
         SET RESOURCE GROUP
        </code>
       </a>
       statement
            and the
       <a class="link" href="optimizer-hints.html#optimizer-hints-resource-group" title="Resource Group Hint Syntax">
        <code class="literal">
         RESOURCE_GROUP
        </code>
       </a>
       optimizer hint.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_role-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_role-admin">
        <code class="literal">
         ROLE_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251057280">
      </a>
      <a class="indexterm" name="idm46045251055792">
      </a>
      <p>
       Enables granting and revoking roles, use of the
       <code class="literal">
        WITH ADMIN OPTION
       </code>
       clause of the
       <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
        <code class="literal">
         GRANT
        </code>
       </a>
       statement, and nonempty
       <code class="literal">
        &lt;graphml&gt;
       </code>
       element content in the
            result from the
       <a class="link" href="information-functions.html#function_roles-graphml">
        <code class="literal">
         ROLES_GRAPHML()
        </code>
       </a>
       function.
            Required to set the value of the
       <a class="link" href="server-system-variables.html#sysvar_mandatory_roles">
        <code class="literal">
         mandatory_roles
        </code>
       </a>
       system
            variable.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_sensitive-variables-observer">
       </a>
       <a class="link" href="privileges-provided.html#priv_sensitive-variables-observer">
        <code class="literal">
         SENSITIVE_VARIABLES_OBSERVER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251046528">
      </a>
      <a class="indexterm" name="idm46045251045024">
      </a>
      <p>
       Enables a holder to view the values of sensitive system
            variables in the Performance Schema tables
       <a class="link" href="performance-schema-system-variable-tables.html" title="29.12.14 Performance Schema System Variable Tables">
        <code class="literal">
         global_variables
        </code>
       </a>
       ,
       <a class="link" href="performance-schema-system-variable-tables.html" title="29.12.14 Performance Schema System Variable Tables">
        <code class="literal">
         session_variables
        </code>
       </a>
       ,
       <a class="link" href="performance-schema-system-variable-tables.html" title="29.12.14 Performance Schema System Variable Tables">
        <code class="literal">
         variables_by_thread
        </code>
       </a>
       , and
       <a class="link" href="performance-schema-persisted-variables-table.html" title="29.12.14.1 Performance Schema persisted_variables Table">
        <code class="literal">
         persisted_variables
        </code>
       </a>
       , to issue
       <code class="literal">
        SELECT
       </code>
       statements to return their values,
            and to track changes to them in session trackers for
            connections. Users without this privilege cannot view or
            track those system variable values. See
       <a class="xref" href="persisted-system-variables.html#persisted-system-variables-sensitive" title="Persisting Sensitive System Variables">
        Persisting Sensitive System Variables
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_service-connection-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_service-connection-admin">
        <code class="literal">
         SERVICE_CONNECTION_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251034080">
      </a>
      <a class="indexterm" name="idm46045251032576">
      </a>
      <p>
       Enables connections to the network interface that permits
            only administrative connections (see
       <a class="xref" href="connection-interfaces.html" title="7.1.12.1 Connection Interfaces">
        Section 7.1.12.1, “Connection Interfaces”
       </a>
       ).
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_session-variables-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251027776">
      </a>
      <a class="indexterm" name="idm46045251026288">
      </a>
      <p>
       For most system variables, setting the session value
            requires no special privileges and can be done by any user
            to affect the current session. For some system variables,
            setting the session value can have effects outside the
            current session and thus is a restricted operation. For
            these, the
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
       privilege enables the user to set the session value.
      </p>
      <p>
       If a system variable is restricted and requires a special
            privilege to set the session value, the variable description
            indicates that restriction. Examples include
       <a class="link" href="replication-options-binary-log.html#sysvar_binlog_format">
        <code class="literal">
         binlog_format
        </code>
       </a>
       ,
       <a class="link" href="replication-options-binary-log.html#sysvar_sql_log_bin">
        <code class="literal">
         sql_log_bin
        </code>
       </a>
       , and
       <a class="link" href="server-system-variables.html#sysvar_sql_log_off">
        <code class="literal">
         sql_log_off
        </code>
       </a>
       .
      </p>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
       privilege is a subset of the
       <a class="link" href="privileges-provided.html#priv_system-variables-admin">
        <code class="literal">
         SYSTEM_VARIABLES_ADMIN
        </code>
       </a>
       and
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       privileges. A user who
            has either of those privileges is also permitted to set
            restricted session variables and effectively has
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
       by
            implication and need not be granted
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
       explicitly.
      </p>
      <p>
       See also
       <a class="xref" href="system-variable-privileges.html" title="7.1.9.1 System Variable Privileges">
        Section 7.1.9.1, “System Variable Privileges”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_set-any-definer">
       </a>
       <a class="link" href="privileges-provided.html#priv_set-any-definer">
        <code class="literal">
         SET_ANY_DEFINER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045251008368">
      </a>
      <a class="indexterm" name="idm46045251006880">
      </a>
      <p>
       Enables setting the effective authorization ID when
            executing a view or stored program. A user with this
            privilege can specify any account as the
       <code class="literal">
        DEFINER
       </code>
       attribute for
       <a class="link" href="create-procedure.html" title="15.1.17 CREATE PROCEDURE and CREATE FUNCTION Statements">
        <code class="literal">
         CREATE PROCEDURE
        </code>
       </a>
       ,
       <a class="link" href="create-function.html" title="15.1.14 CREATE FUNCTION Statement">
        <code class="literal">
         CREATE FUNCTION
        </code>
       </a>
       ,
       <a class="link" href="create-trigger.html" title="15.1.22 CREATE TRIGGER Statement">
        <code class="literal">
         CREATE TRIGGER
        </code>
       </a>
       ,
       <a class="link" href="create-event.html" title="15.1.13 CREATE EVENT Statement">
        <code class="literal">
         CREATE EVENT
        </code>
       </a>
       ,
       <a class="link" href="alter-event.html" title="15.1.3 ALTER EVENT Statement">
        <code class="literal">
         ALTER EVENT
        </code>
       </a>
       ,
       <a class="link" href="create-view.html" title="15.1.23 CREATE VIEW Statement">
        <code class="literal">
         CREATE VIEW
        </code>
       </a>
       , and
       <a class="link" href="alter-view.html" title="15.1.11 ALTER VIEW Statement">
        <code class="literal">
         ALTER VIEW
        </code>
       </a>
       . Without this
            privilege, only the effective authentication ID can be
            specified.
      </p>
      <p>
       Stored programs execute with the privileges of the specified
            account, so ensure that you follow the risk minimization
            guidelines listed in
       <a class="xref" href="stored-objects-security.html" title="27.6 Stored Object Access Control">
        Section 27.6, “Stored Object Access Control”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_show-routine">
       </a>
       <a class="link" href="privileges-provided.html#priv_show-routine">
        <code class="literal">
         SHOW_ROUTINE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250992080">
      </a>
      <a class="indexterm" name="idm46045250990592">
      </a>
      <p>
       Enables a user to access definitions and properties of all
            stored routines (stored procedures and functions), even
            those for which the user is not named as the routine
       <code class="literal">
        DEFINER
       </code>
       . This access includes:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          The contents of the Information Schema
          <a class="link" href="information-schema-routines-table.html" title="28.3.30 The INFORMATION_SCHEMA ROUTINES Table">
           <code class="literal">
            ROUTINES
           </code>
          </a>
          table.
         </p>
        </li>
        <li class="listitem">
         <p>
          The
          <a class="link" href="show-create-function.html" title="15.7.7.9 SHOW CREATE FUNCTION Statement">
           <code class="literal">
            SHOW CREATE FUNCTION
           </code>
          </a>
          and
          <a class="link" href="show-create-procedure.html" title="15.7.7.10 SHOW CREATE PROCEDURE Statement">
           <code class="literal">
            SHOW CREATE PROCEDURE
           </code>
          </a>
          statements.
         </p>
        </li>
        <li class="listitem">
         <p>
          The
          <a class="link" href="show-function-code.html" title="15.7.7.20 SHOW FUNCTION CODE Statement">
           <code class="literal">
            SHOW FUNCTION CODE
           </code>
          </a>
          and
          <a class="link" href="show-procedure-code.html" title="15.7.7.29 SHOW PROCEDURE CODE Statement">
           <code class="literal">
            SHOW PROCEDURE CODE
           </code>
          </a>
          statements.
         </p>
        </li>
        <li class="listitem">
         <p>
          The
          <a class="link" href="show-function-status.html" title="15.7.7.21 SHOW FUNCTION STATUS Statement">
           <code class="literal">
            SHOW FUNCTION STATUS
           </code>
          </a>
          and
          <a class="link" href="show-procedure-status.html" title="15.7.7.30 SHOW PROCEDURE STATUS Statement">
           <code class="literal">
            SHOW PROCEDURE STATUS
           </code>
          </a>
          statements.
         </p>
        </li>
       </ul>
      </div>
      <p>
       <a class="link" href="privileges-provided.html#priv_show-routine">
        <code class="literal">
         SHOW_ROUTINE
        </code>
       </a>
       may be granted
            instead as a privilege with a more restricted scope that
            permits access to routine definitions. (That is, an
            administrator can rescind global
       <a class="link" href="privileges-provided.html#priv_select">
        <code class="literal">
         SELECT
        </code>
       </a>
       from users that do not
            otherwise require it and grant
       <a class="link" href="privileges-provided.html#priv_show-routine">
        <code class="literal">
         SHOW_ROUTINE
        </code>
       </a>
       instead.) This
            enables an account to back up stored routines without
            requiring a broad privilege.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_skip-query-rewrite">
       </a>
       <a class="link" href="privileges-provided.html#priv_skip-query-rewrite">
        <code class="literal">
         SKIP_QUERY_REWRITE
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250968032">
      </a>
      <a class="indexterm" name="idm46045250966544">
      </a>
      <p>
       Queries issued by a user with this privilege are not subject
            to being rewritten by the
       <code class="literal">
        Rewriter
       </code>
       plugin
            (see
       <a class="xref" href="rewriter-query-rewrite-plugin.html" title="7.6.4 The Rewriter Query Rewrite Plugin">
        Section 7.6.4, “The Rewriter Query Rewrite Plugin”
       </a>
       ).
      </p>
      <p>
       This privilege should be granted to users issuing
            administrative or control statements that should not be
            rewritten, as well as to
       <code class="literal">
        PRIVILEGE_CHECKS_USER
       </code>
       accounts (see
       <a class="xref" href="replication-privilege-checks.html" title="19.3.3 Replication Privilege Checks">
        Section 19.3.3, “Replication Privilege Checks”
       </a>
       ) used to
            apply statements from a replication source.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_system-user">
       </a>
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250959024">
      </a>
      <a class="indexterm" name="idm46045250957536">
      </a>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege
            distinguishes system users from regular users:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          A user with the
          <a class="link" href="privileges-provided.html#priv_system-user">
           <code class="literal">
            SYSTEM_USER
           </code>
          </a>
          privilege is
                a system user.
         </p>
        </li>
        <li class="listitem">
         <p>
          A user without the
          <a class="link" href="privileges-provided.html#priv_system-user">
           <code class="literal">
            SYSTEM_USER
           </code>
          </a>
          privilege is
                a regular user.
         </p>
        </li>
       </ul>
      </div>
      <p>
       The
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege has
            an effect on the accounts to which a given user can apply
            its other privileges, as well as whether the user is
            protected from other accounts:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          A system user can modify both system and regular
                accounts. That is, a user who has the appropriate
                privileges to perform a given operation on regular
                accounts is enabled by possession of
          <a class="link" href="privileges-provided.html#priv_system-user">
           <code class="literal">
            SYSTEM_USER
           </code>
          </a>
          to also
                perform the operation on system accounts. A system
                account can be modified only by system users with
                appropriate privileges, not by regular users.
         </p>
        </li>
        <li class="listitem">
         <p>
          A regular user with appropriate privileges can modify
                regular accounts, but not system accounts. A regular
                account can be modified by both system and regular users
                with appropriate privileges.
         </p>
        </li>
       </ul>
      </div>
      <p>
       This also means that database objects created by users with
            the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege
            cannot be modified or dropped by users without the
            privilege. This also applies to routines for which the
            definer has this privilege.
      </p>
      <p>
       For more information, see
       <a class="xref" href="account-categories.html" title="8.2.11 Account Categories">
        Section 8.2.11, “Account Categories”
       </a>
       .
      </p>
      <p>
       The protection against modification by regular accounts that
            is afforded to system accounts by the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege does
            not apply to regular accounts that have privileges on the
       <code class="literal">
        mysql
       </code>
       system schema and thus can directly
            modify the grant tables in that schema. For full protection,
            do not grant
       <code class="literal">
        mysql
       </code>
       schema privileges to
            regular accounts. See
       <a class="xref" href="account-categories.html#protecting-system-accounts" title="Protecting System Accounts Against Manipulation by Regular Accounts">
        Protecting System Accounts Against Manipulation by Regular Accounts
       </a>
       .
      </p>
      <p>
       If the
       <code class="literal">
        audit_log
       </code>
       plugin is in use (see
       <a class="xref" href="audit-log.html" title="8.4.5 MySQL Enterprise Audit">
        Section 8.4.5, “MySQL Enterprise Audit”
       </a>
       ), accounts with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege are
            automatically assigned the
       <a class="link" href="privileges-provided.html#priv_audit-abort-exempt">
        <code class="literal">
         AUDIT_ABORT_EXEMPT
        </code>
       </a>
       privilege,
            which permits their queries to be executed even if an
       <span class="quote">
        “
        <span class="quote">
         abort
        </span>
        ”
       </span>
       item configured in the filter would
            block them. Accounts with the
       <a class="link" href="privileges-provided.html#priv_system-user">
        <code class="literal">
         SYSTEM_USER
        </code>
       </a>
       privilege can
            therefore be used to regain access to a system following an
            audit misconfiguration.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_system-variables-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_system-variables-admin">
        <code class="literal">
         SYSTEM_VARIABLES_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250928016">
      </a>
      <a class="indexterm" name="idm46045250926528">
      </a>
      <p>
       Affects the following operations and server behaviors:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Enables system variable changes at runtime:
         </p>
         <div class="itemizedlist">
          <ul class="itemizedlist" style="list-style-type: square; ">
           <li class="listitem">
            <p>
             Enables server configuration changes to global
                    system variables with
             <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
              <code class="literal">
               SET
                    GLOBAL
              </code>
             </a>
             and
             <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
              <code class="literal">
               SET
                    PERSIST
              </code>
             </a>
             .
            </p>
           </li>
           <li class="listitem">
            <p>
             Enables server configuration changes to global
                    system variables with
             <a class="link" href="set-variable.html" title="15.7.6.1 SET Syntax for Variable Assignment">
              <code class="literal">
               SET
                    PERSIST_ONLY
              </code>
             </a>
             , if the user also has
             <a class="link" href="privileges-provided.html#priv_persist-ro-variables-admin">
              <code class="literal">
               PERSIST_RO_VARIABLES_ADMIN
              </code>
             </a>
             .
            </p>
           </li>
           <li class="listitem">
            <p>
             Enables setting restricted session system variables
                    that require a special privilege. In effect,
             <a class="link" href="privileges-provided.html#priv_system-variables-admin">
              <code class="literal">
               SYSTEM_VARIABLES_ADMIN
              </code>
             </a>
             implies
             <a class="link" href="privileges-provided.html#priv_session-variables-admin">
              <code class="literal">
               SESSION_VARIABLES_ADMIN
              </code>
             </a>
             without explicitly granting
             <a class="link" href="privileges-provided.html#priv_session-variables-admin">
              <code class="literal">
               SESSION_VARIABLES_ADMIN
              </code>
             </a>
             .
            </p>
           </li>
          </ul>
         </div>
         <p>
          See also
          <a class="xref" href="system-variable-privileges.html" title="7.1.9.1 System Variable Privileges">
           Section 7.1.9.1, “System Variable Privileges”
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Enables changes to global transaction characteristics
                (see
          <a class="xref" href="set-transaction.html" title="15.3.7 SET TRANSACTION Statement">
           Section 15.3.7, “SET TRANSACTION Statement”
          </a>
          ).
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_table-encryption-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_table-encryption-admin">
        <code class="literal">
         TABLE_ENCRYPTION_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250906528">
      </a>
      <a class="indexterm" name="idm46045250905040">
      </a>
      <p>
       Enables a user to override default encryption settings when
       <a class="link" href="server-system-variables.html#sysvar_table_encryption_privilege_check">
        <code class="literal">
         table_encryption_privilege_check
        </code>
       </a>
       is enabled; see
       <a class="xref" href="innodb-data-encryption.html#innodb-schema-tablespace-encryption-default" title="Defining an Encryption Default for Schemas and General Tablespaces">
        Defining an Encryption Default for Schemas and General Tablespaces
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_telemetry-log-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_telemetry-log-admin">
        <code class="literal">
         TELEMETRY_LOG_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250898960">
      </a>
      <a class="indexterm" name="idm46045250897472">
      </a>
      <p>
       Enables telemetry log configuration. This privilege is
            defined by the
       <code class="literal">
        telemetry_log
       </code>
       plugin,
            which is deployed through HeatWave on AWS.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_tp-connection-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_tp-connection-admin">
        <code class="literal">
         TP_CONNECTION_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250892640">
      </a>
      <a class="indexterm" name="idm46045250891152">
      </a>
      <p>
       Enables connecting to the server with a privileged
            connection. When the limit defined by
       <a class="link" href="server-system-variables.html#sysvar_thread_pool_max_transactions_limit">
        <code class="literal">
         thread_pool_max_transactions_limit
        </code>
       </a>
       has been reached, new connections are not permitted, unless
            overridden by
       <a class="link" href="server-system-variables.html#sysvar_thread_pool_longrun_trx_limit">
        <code class="literal">
         thread_pool_longrun_trx_limit
        </code>
       </a>
       .
            A privileged connection ignores the transaction limit and
            permits connecting to the server to increase the transaction
            limit, remove the limit, or kill running transactions. This
            privilege is not granted to any user by default. To
            establish a privileged connection, the user initiating a
            connection must have the
       <a class="link" href="privileges-provided.html#priv_tp-connection-admin">
        <code class="literal">
         TP_CONNECTION_ADMIN
        </code>
       </a>
       privilege.
      </p>
      <p>
       A privileged connection can execute statements and start
            transactions when the limit defined by
       <code class="literal">
        thread_pool_max_transactions_limit
       </code>
       has
            been reached. A privileged connection is placed in the
       <code class="literal">
        Admin
       </code>
       thread group. See
       <a class="xref" href="thread-pool-operation.html#privileged-connections" title="Privileged Connections">
        Privileged Connections
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_transaction-gtid-tag">
       </a>
       <a class="link" href="privileges-provided.html#priv_transaction-gtid-tag">
        <code class="literal">
         TRANSACTION_GTID_TAG
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250880048">
      </a>
      <a class="indexterm" name="idm46045250878560">
      </a>
      <p>
       Required for setting the
       <a class="link" href="replication-options-gtids.html#sysvar_gtid_next">
        <code class="literal">
         gtid_next
        </code>
       </a>
       system variable
            to
       <code class="literal">
        AUTOMATIC:
        <em class="replaceable">
         <code>
          TAG
         </code>
        </em>
       </code>
       or
       <code class="literal">
        UUID:
        <em class="replaceable">
         <code>
          TAG
         </code>
        </em>
        :NUMBER
       </code>
       on a replication source server. In addition, at least one of
       <a class="link" href="privileges-provided.html#priv_system-variables-admin">
        <code class="literal">
         SYSTEM_VARIABLES_ADMIN
        </code>
       </a>
       ,
       <a class="link" href="privileges-provided.html#priv_session-variables-admin">
        <code class="literal">
         SESSION_VARIABLES_ADMIN
        </code>
       </a>
       , or
       <a class="link" href="privileges-provided.html#priv_replication-applier">
        <code class="literal">
         REPLICATION_APPLIER
        </code>
       </a>
       is also
            required to set
       <code class="literal">
        gtid_next
       </code>
       to one of these
            values on the source.
      </p>
      <p>
       The
       <code class="literal">
        REPLICATION_CHECKS_APPLIER
       </code>
       must also
            have this privilege as well as the
       <code class="literal">
        REPLICATION_APPLIER
       </code>
       privilege to set
       <code class="literal">
        gtid_next
       </code>
       to
       <code class="literal">
        AUTOMATIC:
        <em class="replaceable">
         <code>
          TAG
         </code>
        </em>
       </code>
       .
            This is checked when starting the replication applier
            thread.
      </p>
      <p>
       This privilege is also required to set the
       <a class="link" href="replication-options-gtids.html#sysvar_gtid_purged">
        <code class="literal">
         gtid_purged
        </code>
       </a>
       server system
            variable.
      </p>
      <p>
       For more information about using tagged GTIDs, see the
            description of
       <a class="link" href="replication-options-gtids.html#sysvar_gtid_next">
        <code class="literal">
         gtid_next
        </code>
       </a>
       ,
            as well as
       <a class="xref" href="replication-mode-change-online.html" title="19.1.4 Changing GTID Mode on Online Servers">
        Section 19.1.4, “Changing GTID Mode on Online Servers”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_version-token-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_version-token-admin">
        <code class="literal">
         VERSION_TOKEN_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250858704">
      </a>
      <a class="indexterm" name="idm46045250857216">
      </a>
      <p>
       Enables execution of Version Tokens functions. This
            privilege is defined by the
       <code class="literal">
        version_tokens
       </code>
       plugin; see
       <a class="xref" href="version-tokens.html" title="7.6.6 Version Tokens">
        Section 7.6.6, “Version Tokens”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       <a name="priv_xa-recover-admin">
       </a>
       <a class="link" href="privileges-provided.html#priv_xa-recover-admin">
        <code class="literal">
         XA_RECOVER_ADMIN
        </code>
       </a>
      </p>
      <a class="indexterm" name="idm46045250851856">
      </a>
      <a class="indexterm" name="idm46045250850368">
      </a>
      <p>
       Enables execution of the
       <a class="link" href="xa-statements.html" title="15.3.8.1 XA Transaction SQL Statements">
        <code class="literal">
         XA
            RECOVER
        </code>
       </a>
       statement; see
       <a class="xref" href="xa-statements.html" title="15.3.8.1 XA Transaction SQL Statements">
        Section 15.3.8.1, “XA Transaction SQL Statements”
       </a>
       .
      </p>
      <p>
       Prior to MySQL 8.4, any user could execute the
       <a class="link" href="xa-statements.html" title="15.3.8.1 XA Transaction SQL Statements">
        <code class="literal">
         XA
            RECOVER
        </code>
       </a>
       statement to discover the XID values for
            outstanding prepared XA transactions, possibly leading to
            commit or rollback of an XA transaction by a user other than
            the one who started it. In MySQL 8.4,
       <a class="link" href="xa-statements.html" title="15.3.8.1 XA Transaction SQL Statements">
        <code class="literal">
         XA
            RECOVER
        </code>
       </a>
       is permitted only to users who have the
       <a class="link" href="privileges-provided.html#priv_xa-recover-admin">
        <code class="literal">
         XA_RECOVER_ADMIN
        </code>
       </a>
       privilege,
            which is expected to be granted only to administrative users
            who have need for it. This might be the case, for example,
            for administrators of an XA application if it has crashed
            and it is necessary to find outstanding transactions started
            by the application so they can be rolled back. This
            privilege requirement prevents users from discovering the
            XID values for outstanding prepared XA transactions other
            than their own. It does not affect normal commit or rollback
            of an XA transaction because the user who started it knows
            its XID.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="privileges-provided-guidelines">
       </a>
       Privilege-Granting Guidelines
      </h4>
     </div>
    </div>
   </div>
   <p>
    It is a good idea to grant to an account only those privileges
        that it needs. You should exercise particular caution in
        granting the
    <a class="link" href="privileges-provided.html#priv_file">
     <code class="literal">
      FILE
     </code>
    </a>
    and
        administrative privileges:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="privileges-provided.html#priv_file">
        <code class="literal">
         FILE
        </code>
       </a>
       can be abused to read
            into a database table any files that the MySQL server can
            read on the server host. This includes all world-readable
            files and files in the server's data directory. The table
            can then be accessed using
       <a class="link" href="select.html" title="15.2.13 SELECT Statement">
        <code class="literal">
         SELECT
        </code>
       </a>
       to transfer its
            contents to the client host.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="privileges-provided.html#priv_grant-option">
        <code class="literal">
         GRANT OPTION
        </code>
       </a>
       enables users to
            give their privileges to other users. Two users that have
            different privileges and with the
       <a class="link" href="privileges-provided.html#priv_grant-option">
        <code class="literal">
         GRANT
            OPTION
        </code>
       </a>
       privilege are able to combine privileges.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="privileges-provided.html#priv_alter">
        <code class="literal">
         ALTER
        </code>
       </a>
       may be used to subvert
            the privilege system by renaming tables.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="privileges-provided.html#priv_shutdown">
        <code class="literal">
         SHUTDOWN
        </code>
       </a>
       can be abused to
            deny service to other users entirely by terminating the
            server.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="privileges-provided.html#priv_process">
        <code class="literal">
         PROCESS
        </code>
       </a>
       can be used to view
            the plain text of currently executing statements, including
            statements that set or change passwords.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       can be used to
            terminate other sessions or change how the server operates.
      </p>
     </li>
     <li class="listitem">
      <p>
       Privileges granted for the
       <code class="literal">
        mysql
       </code>
       system
            database itself can be used to change passwords and other
            access privilege information:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: circle; ">
        <li class="listitem">
         <p>
          Passwords are stored encrypted, so a malicious user
                cannot simply read them to know the plain text password.
                However, a user with write access to the
          <code class="literal">
           mysql.user
          </code>
          system table
          <code class="literal">
           authentication_string
          </code>
          column can
                change an account's password, and then connect to the
                MySQL server using that account.
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="privileges-provided.html#priv_insert">
           <code class="literal">
            INSERT
           </code>
          </a>
          or
          <a class="link" href="privileges-provided.html#priv_update">
           <code class="literal">
            UPDATE
           </code>
          </a>
          granted for the
          <code class="literal">
           mysql
          </code>
          system database enable a user
                to add privileges or modify existing privileges,
                respectively.
         </p>
        </li>
        <li class="listitem">
         <p>
          <a class="link" href="privileges-provided.html#priv_drop">
           <code class="literal">
            DROP
           </code>
          </a>
          for the
          <code class="literal">
           mysql
          </code>
          system database enables a user
                to remote privilege tables, or even the database itself.
         </p>
        </li>
       </ul>
      </div>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="static-dynamic-privileges">
       </a>
       Static Versus Dynamic Privileges
      </h4>
     </div>
    </div>
   </div>
   <a class="indexterm" name="idm46045250809920">
   </a>
   <a class="indexterm" name="idm46045250808432">
   </a>
   <a class="indexterm" name="idm46045250807360">
   </a>
   <p>
    MySQL supports static and dynamic privileges:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Static privileges are built in to the server. They are
            always available to be granted to user accounts and cannot
            be unregistered.
      </p>
     </li>
     <li class="listitem">
      <p>
       Dynamic privileges can be registered and unregistered at
            runtime. This affects their availability: A dynamic
            privilege that has not been registered cannot be granted.
      </p>
     </li>
    </ul>
   </div>
   <p>
    For example, the
    <a class="link" href="privileges-provided.html#priv_select">
     <code class="literal">
      SELECT
     </code>
    </a>
    and
    <a class="link" href="privileges-provided.html#priv_insert">
     <code class="literal">
      INSERT
     </code>
    </a>
    privileges are static and
        always available, whereas a dynamic privilege becomes available
        only if the component that implements it has been enabled.
   </p>
   <p>
    The remainder of this section describes how dynamic privileges
        work in MySQL. The discussion uses the term
    <span class="quote">
     “
     <span class="quote">
      components
     </span>
     ”
    </span>
    but applies equally to plugins.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     Server administrators should be aware of which server
          components define dynamic privileges. For MySQL distributions,
          documentation of components that define dynamic privileges
          describes those privileges.
    </p>
    <p>
     Third-party components may also define dynamic privileges; an
          administrator should understand those privileges and not
          install components that might conflict or compromise server
          operation. For example, one component conflicts with another
          if both define a privilege with the same name. Component
          developers can reduce the likelihood of this occurrence by
          choosing privilege names having a prefix based on the
          component name.
    </p>
   </div>
   <p>
    The server maintains the set of registered dynamic privileges
        internally in memory. Unregistration occurs at server shutdown.
   </p>
   <p>
    Normally, a component that defines dynamic privileges registers
        them when it is installed, during its initialization sequence.
        When uninstalled, a component does not unregister its registered
        dynamic privileges. (This is current practice, not a
        requirement. That is, components could, but do not, unregister
        at any time privileges they register.)
   </p>
   <p>
    No warning or error occurs for attempts to register an already
        registered dynamic privilege. Consider the following sequence of
        statements:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa38998144"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">INSTALL</span> <span class="token keyword">COMPONENT</span> <span class="token string">'my_component'</span><span class="token punctuation">;</span>
<span class="token keyword">UNINSTALL</span> <span class="token keyword">COMPONENT</span> <span class="token string">'my_component'</span><span class="token punctuation">;</span>
<span class="token keyword">INSTALL</span> <span class="token keyword">COMPONENT</span> <span class="token string">'my_component'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The first
    <a class="link" href="install-component.html" title="15.7.4.3 INSTALL COMPONENT Statement">
     <code class="literal">
      INSTALL COMPONENT
     </code>
    </a>
    statement registers any privileges defined by component
    <code class="literal">
     my_component
    </code>
    , but
    <a class="link" href="uninstall-component.html" title="15.7.4.5 UNINSTALL COMPONENT Statement">
     <code class="literal">
      UNINSTALL COMPONENT
     </code>
    </a>
    does not
        unregister them. For the second
    <a class="link" href="install-component.html" title="15.7.4.3 INSTALL COMPONENT Statement">
     <code class="literal">
      INSTALL
        COMPONENT
     </code>
    </a>
    statement, the component privileges it
        registers are found to be already registered, but no warnings or
        errors occur.
   </p>
   <a class="indexterm" name="idm46045250789472">
   </a>
   <a class="indexterm" name="idm46045250787984">
   </a>
   <a class="indexterm" name="idm46045250786496">
   </a>
   <p>
    Dynamic privileges apply only at the global level. The server
        stores information about current assignments of dynamic
        privileges to user accounts in the
    <code class="literal">
     mysql.global_grants
    </code>
    system table:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The server automatically registers privileges named in
       <code class="literal">
        global_grants
       </code>
       during server startup
            (unless the
       <a class="link" href="server-options.html#option_mysqld_skip-grant-tables">
        <code class="option">
         --skip-grant-tables
        </code>
       </a>
       option is
            given).
      </p>
     </li>
     <li class="listitem">
      <p>
       The
       <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
        <code class="literal">
         GRANT
        </code>
       </a>
       and
       <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
        <code class="literal">
         REVOKE
        </code>
       </a>
       statements modify the
            contents of
       <code class="literal">
        global_grants
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       Dynamic privilege assignments listed in
       <code class="literal">
        global_grants
       </code>
       are persistent. They are
            not removed at server shutdown.
      </p>
     </li>
    </ul>
   </div>
   <p>
    Example: The following statement grants to user
    <code class="literal">
     u1
    </code>
    the privileges required to control
        replication (including Group Replication) on a replica, and to
        modify system variables:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa42845977"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">GRANT</span> REPLICATION_SLAVE_ADMIN<span class="token punctuation">,</span> GROUP_REPLICATION_ADMIN<span class="token punctuation">,</span> BINLOG_ADMIN
<span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    Granted dynamic privileges appear in the output from the
    <code class="literal">
     SHOW GRANTS
    </code>
    statement and the
    <code class="literal">
     INFORMATION_SCHEMA
    </code>
    <a class="link" href="information-schema-user-privileges-table.html" title="28.3.46 The INFORMATION_SCHEMA USER_PRIVILEGES Table">
     <code class="literal">
      USER_PRIVILEGES
     </code>
    </a>
    table.
   </p>
   <p>
    For
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    and
    <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
     <code class="literal">
      REVOKE
     </code>
    </a>
    at the global level, any
        named privileges not recognized as static are checked against
        the current set of registered dynamic privileges and granted if
        found. Otherwise, an error occurs to indicate an unknown
        privilege identifier.
   </p>
   <p>
    For
    <a class="link" href="grant.html" title="15.7.1.6 GRANT Statement">
     <code class="literal">
      GRANT
     </code>
    </a>
    and
    <a class="link" href="revoke.html" title="15.7.1.8 REVOKE Statement">
     <code class="literal">
      REVOKE
     </code>
    </a>
    the meaning of
    <code class="literal">
     ALL [PRIVILEGES]
    </code>
    at the global level includes
        all static global privileges, as well as all currently
        registered dynamic privileges:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <code class="literal">
        GRANT ALL
       </code>
       at the global level grants all
            static global privileges and all currently registered
            dynamic privileges. A dynamic privilege registered
            subsequent to execution of the
       <code class="literal">
        GRANT
       </code>
       statement is not granted retroactively to any account.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        REVOKE ALL
       </code>
       at the global level revokes
            all granted static global privileges and all granted dynamic
            privileges.
      </p>
     </li>
    </ul>
   </div>
   <p>
    The
    <a class="link" href="flush.html#flush-privileges">
     <code class="literal">
      FLUSH PRIVILEGES
     </code>
    </a>
    statement
        reads the
    <code class="literal">
     global_grants
    </code>
    table for dynamic
        privilege assignments and registers any unregistered privileges
        found there.
   </p>
   <p>
    For descriptions of the dynamic privileges provided by MySQL
        Server and components included in MySQL distributions, see
    <a class="xref" href="privileges-provided.html" title="8.2.2 Privileges Provided by MySQL">
     Section 8.2.2, “Privileges Provided by MySQL”
    </a>
    .
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="dynamic-privileges-migration-from-super">
       </a>
       Migrating Accounts from SUPER to Dynamic Privileges
      </h4>
     </div>
    </div>
   </div>
   <p>
    In MySQL 8.4, many operations that previously
        required the
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    privilege are
        also associated with a dynamic privilege of more limited scope.
        (For descriptions of these privileges, see
    <a class="xref" href="privileges-provided.html" title="8.2.2 Privileges Provided by MySQL">
     Section 8.2.2, “Privileges Provided by MySQL”
    </a>
    .) Each such operation can
        be permitted to an account by granting the associated dynamic
        privilege rather than
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    . This
        change improves security by enabling DBAs to avoid granting
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    and tailor user privileges
        more closely to the operations permitted.
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    is now deprecated; expect
        it to be removed in a future version of MySQL.
   </p>
   <p>
    When removal of
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    occurs,
        operations that formerly required
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    fail unless accounts
        granted
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    are migrated to the
        appropriate dynamic privileges. Use the following instructions
        to accomplish that goal so that accounts are ready prior to
    <a class="link" href="privileges-provided.html#priv_super">
     <code class="literal">
      SUPER
     </code>
    </a>
    removal:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       Execute this query to identify accounts that are granted
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       :
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa93849218"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SELECT</span> GRANTEE <span class="token keyword">FROM</span> INFORMATION_SCHEMA<span class="token punctuation">.</span>USER_PRIVILEGES
<span class="token keyword">WHERE</span> PRIVILEGE_TYPE <span class="token operator">=</span> <span class="token string">'SUPER'</span><span class="token punctuation">;</span></code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       For each account identified by the preceding query,
            determine the operations for which it needs
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       . Then grant the dynamic
            privileges corresponding to those operations, and revoke
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       .
      </p>
      <p>
       For example, if
       <code class="literal">
        'u1'@'localhost'
       </code>
       requires
       <a class="link" href="privileges-provided.html#priv_super">
        <code class="literal">
         SUPER
        </code>
       </a>
       for binary log purging
            and system variable modification, these statements make the
            required changes to the account:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa71126189"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">GRANT</span> BINLOG_ADMIN<span class="token punctuation">,</span> SYSTEM_VARIABLES_ADMIN <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">TO</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span><span class="token punctuation">;</span>
<span class="token keyword">REVOKE</span> <span class="token keyword">SUPER</span> <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span> <span class="token keyword">FROM</span> <span class="token string">'u1'</span>@<span class="token string">'localhost'</span><span class="token punctuation">;</span></code></pre>
      </div>
      <p>
       After you have modified all applicable accounts, the
       <code class="literal">
        INFORMATION_SCHEMA
       </code>
       query in the first
            step should produce an empty result set.
      </p>
     </li>
    </ol>
   </div>
  </div>
 </div>
 <br/>
</div>
