Granting schema-level privileges and not global privileges: 

•Adding a new schema: The schema is inaccessible to existing accounts by default. For any account to which the schema should be accessible, the DBA must grant schema-level access. 

•Adding a new account: The DBA must grant schema-level access for each schema to which the account should have access. 

Granting global privileges in conjunction with partial revokes: 

•Adding a new schema: The schema is accessible to existing accounts that have global privileges. For any such account to which the schema should be inaccessible, the DBA must add a partial revoke. 

•Adding a new account: The DBA must grant the global privileges, plus a partial revoke on each restricted schema. 

The approach that uses explicit schema-level grant is more convenient for accounts for which access is limited to a few schemas. The approach that uses partial revokes is more convenient for accounts with broad access to all schemas except a few. 

## Disabling Partial Revokes 

Once enabled, partial_revokes  cannot be disabled if any account has privilege restrictions. If any such account exists, disabling partial_revokes  fails: 

•For attempts to disable partial_revokes  at startup, the server logs an error message and enables partial_revokes . 

•For attempts to disable partial_revokes  at runtime, an error occurs and the partial_revokes value remains unchanged. 

To disable partial_revokes  when restrictions exist, the restrictions first must be removed: 

1. Determine which accounts have partial revokes: 

SELECT User, Host, User_attributes->>’$.Restrictions’ FROM mysql.user WHERE User_attributes->>’$.Restrictions’ <> ’’; 

2. For each such account, remove its privilege restrictions. Suppose that the previous step shows account u1  to have these restrictions: 

[{"Database": "world", "Privileges": ["INSERT", "DELETE"] 

Restriction removal can be done various ways: 

•Grant the privileges globally, without restrictions: 

GRANT INSERT, DELETE ON *.* TO u1; 

•Grant the privileges at the schema level: 

GRANT INSERT, DELETE ON world.* TO u1; 

•Revoke the privileges globally (assuming that they are no longer needed): 

REVOKE INSERT, DELETE ON *.* FROM u1; 

•Remove the account itself (assuming that it is no longer needed): 

DROP USER u1; 

