Privilege Restriction Using Partial Revokes mysql>  REVOKE SELECT ON mysql.* FROM admin; mysql>  SHOW GRANTS FOR admin; +------------------------------------------------------+ | Grants for admin@% | +------------------------------------------------------+ | GRANT SELECT ON *.* TO ‘admin‘@‘%‘ WITH GRANT OPTION | | REVOKE SELECT ON ‘mysql‘.* FROM ‘admin‘@‘%‘ | +------------------------------------------------------+ mysql>  GRANT SELECT ON *.* TO u1; mysql>  SHOW GRANTS FOR u1; +------------------------------------------+ | Grants for u1@% | +------------------------------------------+ | GRANT SELECT ON *.* TO ‘u1‘@‘%‘ | | REVOKE SELECT ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +------------------------------------------+ mysql>  GRANT SELECT ON *.* TO u2; mysql>  SHOW GRANTS FOR u2; +---------------------------------+ | Grants for u2@% | +---------------------------------+ | GRANT SELECT ON *.* TO ‘u2‘@‘%‘ | +---------------------------------+ •On the other hand,  u2  already holds a global  SELECT  privilege without restriction.  GRANT  can only add to a grantee’s existing privileges, not reduce them, so if  admin  grants  SELECT  globally to  u2 ,  u2  does not inherit the  admin  restriction: •If  admin  grants  SELECT  globally to  u1 , who has no  SELECT  privilege to begin with,  u1  inherits the admin  privilege restriction: Aggregation of privilege restrictions applies both when privileges are partially revoked explicitly (as just shown) and when restrictions are inherited implicitly from the user who executes the statement or the user mentioned in an  AS  user  clause. 1239 mysql>  CREATE USER u1; mysql>  GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1; mysql>  REVOKE INSERT ON mysql.* FROM u1; mysql>  SHOW GRANTS FOR u1; +---------------------------------------------------------+ | Grants for u1@% | +---------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE INSERT ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +---------------------------------------------------------+ mysql>  REVOKE DELETE, UPDATE ON db2.* FROM u1; mysql>  SHOW GRANTS FOR u1; +---------------------------------------------------------+ | Grants for u1@% | +---------------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO ‘u1‘@‘%‘ | | REVOKE UPDATE, DELETE ON ‘db2‘.* FROM ‘u1‘@‘%‘ | | REVOKE INSERT ON ‘mysql‘.* FROM ‘u1‘@‘%‘ | +---------------------------------------------------------+ Restrictions on new privileges granted to an account are added to any existing restrictions for that account: If a  GRANT  statement includes an  AS  user  clause, the privilege restrictions applied are those on the user/ role combination specified by the clause, rather than those on the user who executes the statement. For information about the  AS  clause, see Section 13.7.1.6, “GRANT Statement” . If  admin  grants  SELECT  globally to  u1  and  u2 , the result differs for each user: