mysql> REVOKE SELECT ON mysql.* FROM admin; mysql> SHOW GRANTS FOR admin; +------------------------------------------------------+ | Grants for admin@% | +------------------------------------------------------+ | GRANT SELECT ON *.* TO ‘admin‘@‘%‘ WITH GRANT OPTION | | REVOKE SELECT ON ‘mysql‘.* FROM ‘admin‘@‘%‘ | +------------------------------------------------------+ 

If admin  grants SELECT  globally to u1  and u2 , the result differs for each user: 

•If admin  grants SELECT  globally to u1 , who has no SELECT  privilege to begin with, u1  inherits the admin  privilege restriction: 

mysql> GRANT SELECT ON *.* TO u1; mysql> SHOW GRANTS FOR u1; +------------------------------------------+ | Grants for u1@% | +------------------------------------------+ | GRANT SELECT ON *.* TO ‘u1‘@‘%‘ | | REVOKE SELECT ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +------------------------------------------+ 

•On the other hand, u2  already holds a global SELECT  privilege without restriction. GRANT  can only add to a grantee’s existing privileges, not reduce them, so if admin  grants SELECT  globally to u2 , u2  does not inherit the admin  restriction: 

mysql> GRANT SELECT ON *.* TO u2; mysql> SHOW GRANTS FOR u2; +---------------------------------+ | Grants for u2@% | +---------------------------------+ | GRANT SELECT ON *.* TO ‘u2‘@‘%‘ | +---------------------------------+ 

If a GRANT  statement includes an AS user  clause, the privilege restrictions applied are those on the user/ role combination specified by the clause, rather than those on the user who executes the statement. For information about the AS  clause, see Section 13.7.1.6, “GRANT Statement” . 

Restrictions on new privileges granted to an account are added to any existing restrictions for that account: 

mysql> CREATE USER u1; mysql> GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1; mysql> REVOKE INSERT ON mysql.* FROM u1; mysql> SHOW GRANTS FOR u1; +---------------------------------------------------------+ | Grants for u1@% | +---------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE INSERT ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +---------------------------------------------------------+ mysql> REVOKE DELETE, UPDATE ON db2.* FROM u1; mysql> SHOW GRANTS FOR u1; +---------------------------------------------------------+ | Grants for u1@% | +---------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE UPDATE, DELETE ON ‘db2‘.* FROM ‘u1‘@‘%‘ | | REVOKE INSERT ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +---------------------------------------------------------+ 

Aggregation of privilege restrictions applies both when privileges are partially revoked explicitly (as just shown) and when restrictions are inherited implicitly from the user who executes the statement or the user mentioned in an AS user  clause. 

