Account Management Statements As mentioned previously, the  AS  clause can only add privilege restrictions; it cannot escalate privileges. Thus, although  u1  has the  DELETE  privilege, that is not included in the privileges granted because the statement does not specify granting  DELETE . If a  GRANT  statement includes an  AS  user  clause, privilege restrictions on the user who executes the statement are ignored (rather than applied as they would be in the absence of an  AS  clause). The optional  WITH  clause is used to enable a user to grant privileges to other users. The  WITH GRANT OPTION  clause gives the user the ability to give to other users any privileges the user has at the specified privilege level. To grant the  GRANT OPTION  privilege to an account without otherwise changing its privileges, do this: Be careful to whom you give the  GRANT OPTION  privilege because two users with different privileges may be able to combine privileges! You cannot grant another user a privilege which you yourself do not have; the  GRANT OPTION  privilege enables you to assign only those privileges which you yourself possess. Be aware that when you grant a user the  GRANT OPTION  privilege at a particular privilege level, any privileges the user possesses (or may be given in the future) at that level can also be granted by that user to other users. Suppose that you grant a user the  INSERT  privilege on a database. If you then grant the SELECT  privilege on the database and specify  WITH GRANT OPTION , that user can give to other users not only the  SELECT  privilege, but also  INSERT . If you then grant the  UPDATE  privilege to the user on the database, the user can grant  INSERT ,  SELECT , and  UPDATE . For a nonadministrative user, you should not grant the  ALTER  privilege globally or for the  mysql  system schema. If you do that, the user can try to subvert the privilege system by renaming tables! For additional information about security risks associated with particular privileges, see Section 6.2.2, “Privileges Provided by MySQL” . The biggest differences between the MySQL and standard SQL versions of  GRANT  are: 2875 •Standard SQL does not have global or database-level privileges, nor does it support all the privilege types that MySQL supports. •MySQL associates privileges with the combination of a host name and user name and not with only a user name. MySQL and Standard SQL Versions of GRANT Other Account Characteristics GRANT USAGE ON *.* TO ’someuser’@’somehost’ WITH GRANT OPTION; mysql>  CREATE USER u4; mysql>  GRANT SELECT, INSERT, UPDATE ON *.* TO u4 AS u1 WITH ROLE r1; mysql>  SHOW GRANTS FOR u4; +-------------------------------------------------+ | Grants for u4@% | +-------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE ON *.* TO ‘u4‘@‘%‘ | | REVOKE UPDATE ON ‘schema1‘.* FROM ‘u4‘@‘%‘ | +-------------------------------------------------+ •The  AS  clause for the  GRANT  statement here makes the role  r1  active for  u1 . That role lifts some of the restrictions on  u1 . Consequently, the privileges granted have some restrictions, but not so many as for the previous  GRANT  statement: