How do I review the permissions of my current MySQL account?
SHOW GRANTS reports account grants without changing them. Match those grants to the account MySQL actually authenticated, especially when the same username has multiple host-specific entries. In MySQL 8, role assignments and the roles active in the current session also affect what the account can do.
Before you start
- An authenticated session using the account being reviewed.
- A documented list of the application’s required operations.
Instructions
1. Identify the authenticated account
USER and CURRENT_USER can differ because connection identity and privilege matching are not identical. Record the effective account before reviewing permissions.
SELECT USER(), CURRENT_USER(), CURRENT_ROLE();Shows the connection identity, authenticated account and active role information.
2. Read current grants
Inspect schema scope and administrative capabilities as well as ordinary read/write permissions. The output can contain role assignments; a role’s permissions require their own review.
SHOW GRANTS FOR CURRENT_USER;Displays grants for the current authenticated account without modifying them.
3. Compare with the intended task
An application commonly needs access only to its own schema and operations. Administrative privileges, grant options and wildcard host access require a separate justification. Have the authorised database administrator inspect role-derived privileges when needed rather than assuming direct grants are the entire effective policy.
Check the result
- You can identify the actual account, its schema scope and any active roles relevant to the task.
- A proposed permission correction names the specific missing operation or excess privilege.
Troubleshooting
- The application can log in but a query is denied
- Compare the denied operation with grants and active roles in the same connection context. Successful authentication does not imply permission for every table or statement.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.