logging, some administrator-level privileges might be required for the PRIVILEGE_CHECKS_USER  account to execute transactions successfully. From MySQL 8.0.19, the REQUIRE_ROW_FORMAT  setting can be applied to secured channels, which restricts the channel from executing events that would require these privileges. 

The REPLICATION_APPLIER  privilege explicitly or implicitly allows the PRIVILEGE_CHECKS_USER account to carry out the following operations that a replication thread needs to perform: 

•Setting the value of the system variables gtid_next , original_commit_timestamp , original_server_version , immediate_server_version , and pseudo_slave_mode , to apply appropriate metadata and behaviors when executing transactions. 

•Executing internal-use BINLOG  statements to apply mysqlbinlog  output, provided that the account also has permission for the tables and operations in those statements. 

•Updating the system tables mysql.gtid_executed , mysql.slave_relay_log_info , mysql.slave_worker_info , and mysql.slave_master_info , to update replication metadata. (If events access these tables explicitly for other purposes, you must grant the appropriate privileges on the tables.) 

•Applying a binary log Table_map_log_event , which provides table metadata but does not make any database changes. 

If the REQUIRE_TABLE_PRIMARY_KEY_CHECK  option of the CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  statement is set to the default of STREAM , the PRIVILEGE_CHECKS_USER  account needs privileges sufficient to set restricted session variables, so that it can change the value of the sql_require_primary_key  system variable for the duration of a session to match the setting replicated from the source. The SESSION_VARIABLES_ADMIN  privilege gives the account this capability. This privilege also allows the account to apply mysqlbinlog  output that was created using the --disable- log-bin  option. If you set REQUIRE_TABLE_PRIMARY_KEY_CHECK  to either ON  or OFF , the replica always uses that value for the sql_require_primary_key  system variable in replication operations, and so does not need these session administration level privileges. 

If table encryption is in use, the table_encryption_privilege_check  system variable is set to ON , and the encryption setting for the tablespace involved in any event differs from the applying server’s default encryption setting (specified by the default_table_encryption  system variable), the PRIVILEGE_CHECKS_USER  account needs the TABLE_ENCRYPTION_ADMIN  privilege in order to override the default encryption setting. It is strongly recommended that you do not grant this privilege. Instead, ensure that the default encryption setting on a replica matches the encryption status of the tablespaces that it replicates, and that replication group members have the same default encryption setting, so that the privilege is not needed. 

In order to execute specific replicated transactions from the relay log, or transactions from mysqlbinlog output as required, the PRIVILEGE_CHECKS_USER  account must have the following privileges: 

•For a row insertion logged in row format (which are logged as a Write_rows_log_event ), the INSERT privilege on the relevant table. 

•For a row update logged in row format (which are logged as an Update_rows_log_event ), the UPDATE  privilege on the relevant table. 

•For a row deletion logged in row format (which are logged as a Delete_rows_log_event ), the DELETE  privilege on the relevant table. 

If statement-based binary logging is in use (which is not recommended with a PRIVILEGE_CHECKS_USER account), for a transaction control statement such as BEGIN  or COMMIT  or DML logged in statement format 

