Account Management Statements •The named  user  should be a MySQL account specified as  ’ user_name ’@’ host_name ’ , CURRENT_USER , or  CURRENT_USER() . The current user may be named together with  WITH ROLE  for the case that the executing user wants  GRANT  to execute with a set of roles applied that may differ from the roles active within the current session. • AS  cannot be used to gain privileges not possessed by the user who executes the  GRANT  statement. The executing user must have at least the privileges to be granted, but the  AS  clause can only restrict the privileges granted, not escalate them. •With respect to the privileges to be granted,  AS  cannot specify a user/role combination that has more privileges (fewer restrictions) than the user who executes the  GRANT  statement. The  AS  user/role combination is permitted to have more privileges than the executing user, but only if the statement does not grant those additional privileges. • AS  is supported only for granting global privileges ( ON *.* ). • AS  is not supported for  PROXY  grants. The following example illustrates the effect of the  AS  clause. Create a user  u1  that has some global privileges, as well as restrictions on those privileges: Also create a role  r1  that lifts some of the privilege restrictions and grant the role to  u1 : Now, using an account that has no privilege restrictions of its own, grant to multiple users the same set of global privileges, but each with different restrictions imposed by the  AS  clause, and check which privileges are actually granted. •The  GRANT  statement here has an  AS  clause, so the privileges granted are those specified but with the restrictions from  u1  applied: •The  GRANT  statement here has no  AS  clause, so the privileges granted are exactly those specified: CREATE USER u1; GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1; REVOKE INSERT, UPDATE ON schema1.* FROM u1; REVOKE SELECT ON schema2.* FROM u1; CREATE ROLE r1; GRANT INSERT ON schema1.* TO r1; GRANT SELECT ON schema2.* TO r1; GRANT r1 TO u1; mysql>  CREATE USER u2; mysql>  GRANT SELECT, INSERT, UPDATE ON *.* TO u2; mysql>  SHOW GRANTS FOR u2; +-------------------------------------------------+ | Grants for u2@% | +-------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE ON *.* TO ‘u2‘@‘%‘ | +-------------------------------------------------+ mysql>  CREATE USER u3; mysql>  GRANT SELECT, INSERT, UPDATE ON *.* TO u3 AS u1; mysql>  SHOW GRANTS FOR u3; +----------------------------------------------------+ | Grants for u3@% | +----------------------------------------------------+ | GRANT SELECT, INSERT, UPDATE ON *.* TO ‘u3‘@‘%‘ | | REVOKE INSERT, UPDATE ON ‘schema1‘.* FROM ‘u3‘@‘%‘ | | REVOKE SELECT ON ‘schema2‘.* FROM ‘u3‘@‘%‘ | +----------------------------------------------------+ 2874