Using Roles To create the roles, use the  CREATE ROLE  statement: Role names are much like user account names and consist of a user part and host part in ’ user_name ’@’ host_name ’  format. The host part, if omitted, defaults to  ’%’ . The user and host parts can be unquoted unless they contain special characters such as  -  or  % . Unlike account names, the user part of role names cannot be blank. For additional information, see Section 6.2.5, “Specifying Role Names” . To assign privileges to the roles, execute  GRANT  statements using the same syntax as for assigning privileges to user accounts: Now suppose that initially you require one developer account, two user accounts that need read-only access, and one user account that needs read/write access. Use  CREATE USER  to create the accounts: To assign each user account its required privileges, you could use  GRANT  statements of the same form as just shown, but that requires enumerating individual privileges for each user. Instead, use an alternative GRANT  syntax that permits granting roles rather than privileges: The  GRANT  statement for the  rw_user1  account grants the read and write roles, which combine to provide the required read and write privileges. The  GRANT  syntax for granting roles to an account differs from the syntax for granting privileges: There is an  ON  clause to assign privileges, whereas there is no  ON  clause to assign roles. Because the syntaxes are distinct, you cannot mix assigning privileges and roles in the same statement. (It is permitted to assign both privileges and roles to an account, but you must use separate  GRANT  statements, each with syntax appropriate to what is to be granted.) As of MySQL 8.0.16, roles cannot be granted to anonymous users. A role when created is locked, has no password, and is assigned the default authentication plugin. (These role attributes can be changed later with the  ALTER USER  statement, by users who have the global CREATE USER  privilege.) While locked, a role cannot be used to authenticate to the server. If unlocked, a role can be used to authenticate. This is because roles and users are both authorization identifiers with much in common and little to distinguish them. See also User and Role Interchangeability. It is possible to specify roles as mandatory by naming them in the value of the  mandatory_roles  system variable. The server treats a mandatory role as granted to all users, so that it need not be granted explicitly to any account. To specify mandatory roles at server startup, define  mandatory_roles  in your server  my.cnf  file: Defining Mandatory Roles 1227 [mysqld] GRANT ’app_developer’ TO ’dev1’@’localhost’; GRANT ’app_read’ TO ’read_user1’@’localhost’, ’read_user2’@’localhost’; GRANT ’app_read’, ’app_write’ TO ’rw_user1’@’localhost’; CREATE USER ’dev1’@’localhost’ IDENTIFIED BY ’dev1pass’; CREATE USER ’read_user1’@’localhost’ IDENTIFIED BY ’read_user1pass’; CREATE USER ’read_user2’@’localhost’ IDENTIFIED BY ’read_user2pass’; CREATE USER ’rw_user1’@’localhost’ IDENTIFIED BY ’rw_user1pass’; GRANT ALL ON app_db.* TO ’app_developer’; GRANT SELECT ON app_db.* TO ’app_read’; GRANT INSERT, UPDATE, DELETE ON app_db.* TO ’app_write’; CREATE ROLE ’app_developer’, ’app_read’, ’app_write’;