Account Categories concept of system user enables restricting modifications to the  root  account (itself a system account) so they can be made only by system users. Regular users with the  CREATE USER  privilege can still modify or drop existing accounts, but only regular accounts. The  SYSTEM_USER  privilege affects these operations: Account manipulation includes creating and dropping accounts, granting and revoking privileges, changing account authentication characteristics such as credentials or authentication plugin, and changing other account characteristics such as password expiration policy. The  SYSTEM_USER  privilege is required to manipulate system accounts using account-management statements such as  CREATE USER  and  GRANT . To prevent an account from modifying system accounts this way, make it a regular account by not granting it the  SYSTEM_USER  privilege. (However, to fully protect system accounts against regular accounts, you must also withhold modification privileges for the mysql  system schema from regular accounts. See Protecting System Accounts Against Manipulation by Regular Accounts.) To kill a session or statement that is executing with the  SYSTEM_USER  privilege, your own session must have the  SYSTEM_USER  privilege, in addition to any other required privilege ( CONNECTION_ADMIN  or the deprecated  SUPER  privilege). Prior to MySQL 8.0.16,  CONNECTION_ADMIN  privilege (or the deprecated  SUPER  privilege) is sufficient to kill any session or statement. To set the  DEFINER  attribute for a stored object to an account that has the  SYSTEM_USER  privilege, you must have the  SYSTEM_USER  privilege, in addition to any other required privilege ( SET_USER_ID  or the deprecated  SUPER  privilege). Prior to MySQL 8.0.16, the  SET_USER_ID  privilege (or the deprecated  SUPER  privilege) is sufficient to specify any  DEFINER  value for stored objects. A role that has the  SYSTEM_USER  privilege cannot be listed in the value of the  mandatory_roles system variable. Prior to MySQL 8.0.16, any role can be listed in  mandatory_roles . Sessions executing within the server are distinguished as system or regular sessions, similar to the distinction between system and regular users: •A session that possesses the  SYSTEM_USER  privilege is a system session. •A session that does not possess the  SYSTEM_USER  privilege is a regular session. •Account manipulation. •Killing current sessions and statements executing within them. •Setting the  DEFINER  attribute for stored objects. •Specifying mandatory roles. A regular session is able to perform only operations permitted to regular users. A system session is additionally able to perform operations permitted only to system users. System and Regular Sessions Operations Affected by the SYSTEM_USER Privilege 1234