Replication Privilege Checks logging, some administrator-level privileges might be required for the  PRIVILEGE_CHECKS_USER  account to execute transactions successfully. From MySQL 8.0.19, the  REQUIRE_ROW_FORMAT  setting can be applied to secured channels, which restricts the channel from executing events that would require these privileges. The  REPLICATION_APPLIER  privilege explicitly or implicitly allows the  PRIVILEGE_CHECKS_USER account to carry out the following operations that a replication thread needs to perform: •Setting the value of the system variables  gtid_next ,  original_commit_timestamp , original_server_version ,  immediate_server_version , and  pseudo_slave_mode , to apply appropriate metadata and behaviors when executing transactions. •Executing internal-use  BINLOG  statements to apply  mysqlbinlog  output, provided that the account also has permission for the tables and operations in those statements. •Updating the system tables  mysql.gtid_executed ,  mysql.slave_relay_log_info , mysql.slave_worker_info , and  mysql.slave_master_info , to update replication metadata. (If events access these tables explicitly for other purposes, you must grant the appropriate privileges on the tables.) •Applying a binary log  Table_map_log_event , which provides table metadata but does not make any database changes. If the  REQUIRE_TABLE_PRIMARY_KEY_CHECK  option of the  CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  statement is set to the default of  STREAM , the  PRIVILEGE_CHECKS_USER  account needs privileges sufficient to set restricted session variables, so that it can change the value of the sql_require_primary_key  system variable for the duration of a session to match the setting replicated from the source. The  SESSION_VARIABLES_ADMIN  privilege gives the account this capability. This privilege also allows the account to apply  mysqlbinlog  output that was created using the  --disable- log-bin  option. If you set  REQUIRE_TABLE_PRIMARY_KEY_CHECK  to either  ON  or  OFF , the replica always uses that value for the  sql_require_primary_key  system variable in replication operations, and so does not need these session administration level privileges. If table encryption is in use, the  table_encryption_privilege_check  system variable is set to ON , and the encryption setting for the tablespace involved in any event differs from the applying server’s default encryption setting (specified by the  default_table_encryption  system variable), the PRIVILEGE_CHECKS_USER  account needs the  TABLE_ENCRYPTION_ADMIN  privilege in order to override the default encryption setting. It is strongly recommended that you do not grant this privilege. Instead, ensure that the default encryption setting on a replica matches the encryption status of the tablespaces that it replicates, and that replication group members have the same default encryption setting, so that the privilege is not needed. In order to execute specific replicated transactions from the relay log, or transactions from  mysqlbinlog output as required, the  PRIVILEGE_CHECKS_USER  account must have the following privileges: •For a row insertion logged in row format (which are logged as a  Write_rows_log_event ), the  INSERT privilege on the relevant table. •For a row update logged in row format (which are logged as an  Update_rows_log_event ), the UPDATE  privilege on the relevant table. •For a row deletion logged in row format (which are logged as a  Delete_rows_log_event ), the DELETE  privilege on the relevant table. If statement-based binary logging is in use (which is not recommended with a  PRIVILEGE_CHECKS_USER account), for a transaction control statement such as  BEGIN  or  COMMIT  or DML logged in statement format 3625