Using Roles To set and persist  mandatory_roles  at runtime, use a statement like this: SET PERSIST  sets the value for the running MySQL instance. It also saves the value, causing it to carry over to subsequent server restarts. To change the value for the running MySQL instance without having it carry over to subsequent restarts, use the  GLOBAL  keyword rather than  PERSIST . See Section 13.7.6.1, “SET Syntax for Variable Assignment” . Setting  mandatory_roles  requires the  ROLE_ADMIN  privilege, in addition to the SYSTEM_VARIABLES_ADMIN  privilege (or the deprecated  SUPER  privilege) normally required to set a global system variable. Mandatory roles, like explicitly granted roles, do not take effect until activated (see Activating Roles). At login time, role activation occurs for all granted roles if the  activate_all_roles_on_login  system variable is enabled, or for roles that are set as default roles otherwise. At runtime,  SET ROLE  activates roles. Roles named in the value of  mandatory_roles  cannot be revoked with  REVOKE  or dropped with  DROP ROLE  or  DROP USER . To prevent sessions from being made system sessions by default, a role that has the  SYSTEM_USER privilege cannot be listed in the value of the  mandatory_roles  system variable: If a role named in  mandatory_roles  is not present in the  mysql.user  system table, the role is not granted to users. When the server attempts role activation for a user, it does not treat the nonexistent role as mandatory and writes a warning to the error log. If the role is created later and thus becomes valid, FLUSH PRIVILEGES  may be necessary to cause the server to treat it as mandatory. SHOW GRANTS  displays mandatory roles according to the rules described in Section 13.7.7.21, “SHOW GRANTS Statement” . To verify the privileges assigned to an account, use  SHOW GRANTS . For example: However, that shows each granted role without “expanding”  it to the privileges the role represents. To show role privileges as well, add a  USING  clause naming the granted roles for which to display privileges: Checking Role Privileges 1228 mysql>  SHOW GRANTS FOR ’dev1’@’localhost’; +-------------------------------------------------+ | Grants for dev1@localhost | +-------------------------------------------------+ | GRANT USAGE ON *.* TO ‘dev1‘@‘localhost‘ | | GRANT ‘app_developer‘@‘%‘ TO ‘dev1‘@‘localhost‘ | +-------------------------------------------------+ mysql>  SHOW GRANTS FOR ’dev1’@’localhost’ USING ’app_developer’; +----------------------------------------------------------+ | Grants for dev1@localhost | +----------------------------------------------------------+ •If  mandatory_roles  is assigned a role at startup that has the  SYSTEM_USER  privilege, the server writes a message to the error log and exits. •If  mandatory_roles  is assigned a role at runtime that has the  SYSTEM_USER  privilege, an error occurs and the  mandatory_roles  value remains unchanged. SET PERSIST mandatory_roles = ’role1,role2@localhost,r3@%.example.com’; mandatory_roles=’role1,role2@localhost,r3@%.example.com’