Privilege Restriction Using Partial Revokes Granting schema-level privileges and not global privileges: The approach that uses explicit schema-level grant is more convenient for accounts for which access is limited to a few schemas. The approach that uses partial revokes is more convenient for accounts with broad access to all schemas except a few. Once enabled,  partial_revokes  cannot be disabled if any account has privilege restrictions. If any such account exists, disabling  partial_revokes  fails: Granting global privileges in conjunction with partial revokes: To disable  partial_revokes  when restrictions exist, the restrictions first must be removed: DROP USER u1; 1242 REVOKE INSERT, DELETE ON *.* FROM u1; GRANT INSERT, DELETE ON world.* TO u1; GRANT INSERT, DELETE ON *.* TO u1; Restriction removal can be done various ways: [{"Database": "world", "Privileges": ["INSERT", "DELETE"] SELECT User, Host, User_attributes->>’$.Restrictions’ FROM mysql.user WHERE User_attributes->>’$.Restrictions’ <> ’’; •Adding a new schema: The schema is inaccessible to existing accounts by default. For any account to which the schema should be accessible, the DBA must grant schema-level access. •Adding a new account: The DBA must grant schema-level access for each schema to which the account should have access. •Adding a new schema: The schema is accessible to existing accounts that have global privileges. For any such account to which the schema should be inaccessible, the DBA must add a partial revoke. •Adding a new account: The DBA must grant the global privileges, plus a partial revoke on each restricted schema. Disabling Partial Revokes •For attempts to disable  partial_revokes  at startup, the server logs an error message and enables partial_revokes . •For attempts to disable  partial_revokes  at runtime, an error occurs and the  partial_revokes value remains unchanged. 1. Determine which accounts have partial revokes: 2. For each such account, remove its privilege restrictions. Suppose that the previous step shows account u1  to have these restrictions: •Grant the privileges globally, without restrictions: •Grant the privileges at the schema level: •Revoke the privileges globally (assuming that they are no longer needed): •Remove the account itself (assuming that it is no longer needed):