Why should you care?

Contractor leaves — revoke one role instead of hunting individual grants across schemas.

See it live — copy this example

Run in MySQL Workbench or the mysql CLI.

CREATE ROLE IF NOT EXISTS 'dataflow_developer';
GRANT SELECT, INSERT, UPDATE, DELETE ON DataFlow.* TO 'dataflow_developer';
CREATE USER IF NOT EXISTS 'dev_priya'@'%' IDENTIFIED BY 'tempPass!';
GRANT 'dataflow_developer' TO 'dev_priya'@'%';
SET DEFAULT ROLE 'dataflow_developer' TO 'dev_priya'@'%';

What happened?

• Role holds privileges on DataFlow schema.
• User dev_priya inherits via role.
• DEFAULT ROLE applies on login without SET ROLE each session.

Practice next

1. CREATE ROLE and GRANT privileges.
2. CREATE USER and GRANT role TO user.
3. Login as dev_priya; run SELECT on orders.
4. CREATE ROLE dataflow_readonly with SELECT only; compare.
5. SHOW GRANTS FOR dev_priya showing role grants.

Remember

Roles group privileges for job functions. DEFAULT ROLE simplifies login. REVOKE role TO removes access batch.

DataFlow team access

Intern gets dataflow_readonly role; senior gets dataflow_developer.

Outcome: Access reviews map to roles not individuals.