REVOKE ALL [PRIVILEGES], GRANT OPTION FROM user_or_role  [, user_or_role ] ... REVOKE PROXY ON user_or_role FROM user_or_role  [, user_or_role ] ... REVOKE role  [, role  ] ... FROM user_or_role  [, user_or_role  ] ... user_or_role : { user  (see Section 6.2.4, “Specifying Account Names” ) | role  (see Section 6.2.5, “Specifying Role Names” . } 

The REVOKE  statement enables system administrators to revoke privileges and roles, which can be revoked from user accounts and roles. 

For details on the levels at which privileges exist, the permissible priv_type , priv_level , and object_type  values, and the syntax for specifying users and passwords, see Section 13.7.1.6, “GRANT Statement” . 

For information about roles, see Section 6.2.10, “Using Roles” . 

When the read_only  system variable is enabled, REVOKE  requires the CONNECTION_ADMIN  or privilege (or the deprecated SUPER  privilege), in addition to any other required privileges described in the following discussion. 

REVOKE  either succeeds for all named users and roles or rolls back and has no effect if any error occurs. The statement is written to the binary log only if it succeeds for all named users and roles. 

Each account name uses the format described in Section 6.2.4, “Specifying Account Names” . Each role name uses the format described in Section 6.2.5, “Specifying Role Names” . For example: 

REVOKE INSERT ON *.* FROM ’jeffrey’@’localhost’; REVOKE ’role1’, ’role2’ FROM ’user1’@’localhost’, ’user2’@’localhost’; REVOKE SELECT ON world.* FROM ’role3’; 

The host name part of the account or role name, if omitted, defaults to ’%’ . 

To use the first REVOKE  syntax, you must have the GRANT OPTION  privilege, and you must have the privileges that you are revoking. 

To revoke all privileges, use the second syntax, which drops all global, database, table, column, and routine privileges for the named users or roles: 

REVOKE ALL PRIVILEGES, GRANT OPTION FROM user_or_role  [, user_or_role ] ... 

REVOKE ALL PRIVILEGES, GRANT OPTION  does not revoke any roles. 

To use this REVOKE  syntax, you must have the global CREATE USER  privilege, or the UPDATE  privilege for the mysql  system schema. 

The syntax for which the REVOKE  keyword is followed by one or more role names takes a FROM  clause indicating one or more users or roles from which to revoke the roles. 

Roles named in the mandatory_roles  system variable value cannot be revoked. 

A revoked role immediately affects any user account from which it was revoked, such that within any current session for the account, its privileges are adjusted for the next statement executed. 

