Account Management Statements Granting Roles The  AS  Clause and Privilege Restrictions GRANT  syntax without an  ON  clause grants roles rather than individual privileges. A role is a named collection of privileges; see Section 6.2.10, “Using Roles” . For example: GRANT ’role1’, ’role2’ TO ’user1’@’localhost’, ’user2’@’localhost’; Each role to be granted must exist, as well as each user account or role to which it is to be granted. As of MySQL 8.0.16, roles cannot be granted to anonymous users. Granting a role does not automatically cause the role to be active. For information about role activation and inactivation, see Activating Roles. These privileges are required to grant roles: •If you have the  ROLE_ADMIN  privilege (or the deprecated  SUPER  privilege), you can grant or revoke any role to users or roles. •If you were granted a role with a  GRANT  statement that includes the  WITH ADMIN OPTION  clause, you become able to grant that role to other users or roles, or revoke it from other users or roles, as long as the role is active at such time as you subsequently grant or revoke it. This includes the ability to use WITH ADMIN OPTION  itself. •To grant a role that has the  SYSTEM_USER  privilege, you must have the  SYSTEM_USER  privilege. It is possible to create circular references with  GRANT . For example: CREATE USER ’u1’, ’u2’; CREATE ROLE ’r1’, ’r2’; GRANT ’u1’ TO ’u1’; -- simple loop: u1 => u1 GRANT ’r1’ TO ’r1’; -- simple loop: r1 => r1 GRANT ’r2’ TO ’u2’; GRANT ’u2’ TO ’r2’; -- mixed user/role loop: u2 => r2 => u2 Circular grant references are permitted but add no new privileges or roles to the grantee because a user or role already has its privileges and roles. As of MySQL 8.0.16,  GRANT  has an  AS  user  [WITH ROLE]  clause that specifies additional information about the privilege context to use for statement execution. This syntax is visible at the SQL level, although its primary purpose is to enable uniform replication across all nodes of grantor privilege restrictions imposed by partial revokes, by causing those restrictions to appear in the binary log. For information about partial revokes, see Section 6.2.12, “Privilege Restriction Using Partial Revokes” . When the  AS  user  clause is specified, statement execution takes into account any privilege restrictions associated with the named user, including all roles specified by  WITH ROLE , if present. The result is that the privileges actually granted by the statement may be reduced relative to those specified. These conditions apply to the  AS  user  clause: • AS  has an effect only when the named  user  has privilege restrictions (which implies that the partial_revokes  system variable is enabled). •If  WITH ROLE  is given, all roles named must be granted to the named  user . 2873