concept of system user enables restricting modifications to the root  account (itself a system account) so they can be made only by system users. Regular users with the CREATE USER  privilege can still modify or drop existing accounts, but only regular accounts. 

## Operations Affected by the SYSTEM_USER Privilege 

The SYSTEM_USER  privilege affects these operations: 

•Account manipulation. 

Account manipulation includes creating and dropping accounts, granting and revoking privileges, changing account authentication characteristics such as credentials or authentication plugin, and changing other account characteristics such as password expiration policy. 

The SYSTEM_USER  privilege is required to manipulate system accounts using account-management statements such as CREATE USER  and GRANT . To prevent an account from modifying system accounts this way, make it a regular account by not granting it the SYSTEM_USER  privilege. (However, to fully protect system accounts against regular accounts, you must also withhold modification privileges for the mysql  system schema from regular accounts. See Protecting System Accounts Against Manipulation by Regular Accounts.) 

•Killing current sessions and statements executing within them. 

To kill a session or statement that is executing with the SYSTEM_USER  privilege, your own session must have the SYSTEM_USER  privilege, in addition to any other required privilege ( CONNECTION_ADMIN  or the deprecated SUPER  privilege). 

Prior to MySQL 8.0.16, CONNECTION_ADMIN  privilege (or the deprecated SUPER  privilege) is sufficient to kill any session or statement. 

•Setting the DEFINER  attribute for stored objects. 

To set the DEFINER  attribute for a stored object to an account that has the SYSTEM_USER  privilege, you must have the SYSTEM_USER  privilege, in addition to any other required privilege ( SET_USER_ID  or the deprecated SUPER  privilege). 

Prior to MySQL 8.0.16, the SET_USER_ID  privilege (or the deprecated SUPER  privilege) is sufficient to specify any DEFINER  value for stored objects. 

•Specifying mandatory roles. 

A role that has the SYSTEM_USER  privilege cannot be listed in the value of the mandatory_roles system variable. 

## System and Regular Sessions 

Prior to MySQL 8.0.16, any role can be listed in mandatory_roles . 

Sessions executing within the server are distinguished as system or regular sessions, similar to the distinction between system and regular users: 

•A session that possesses the SYSTEM_USER  privilege is a system session. 

•A session that does not possess the SYSTEM_USER  privilege is a regular session. 

A regular session is able to perform only operations permitted to regular users. A system session is additionally able to perform operations permitted only to system users. 

