# Managing Privileges

__*zz-BGL*__
__*zz-Jeff*__

+ Three access levels of privileges can be granted to a `TiDB` user or role:
  + Global level, database level and table level
  + Simple syntax: **`GRANT {privilege_list} ON {object_scope} TO {user_list} [WITH GRANT OPTION]`**
  + **`{object_scope}`**
    + Global level: **`*.*`**
    + Database level: **`{schema_name}.*`**
    + Table level : **`{schema_name}.{table_name}`**
  + **`WITH GRANT OPTION`**: Give the user the permission to grant others the specific privilege
  + **`{privilege_list}`** can be: **`ALL`**, **`ALTER`**, **`CREATE`**, **`DELETE`**, **`USAGE`**, etc
+ For example:
```
~!@// Global level - Read all tables:@!~
GRANT SELECT ON *.* TO 'user1'@'localhost' WITH GRANT OPTION; ~!@// grant@!~
REVOKE SELECT ON *.* FROM 'user1'@'localhost'; ~!@// revoke@!~

~!@// Database level - Read all tables in the `universe` database:@!~
GRANT SELECT ON universe.* TO 'user1'@'localhost'; ~!@// grant@!~
REVOKE SELECT ON universe.* FROM 'user1'@'localhost'; ~!@// revoke@!~

~!@// Table level - Read `universe.planets` table:@!~
GRANT SELECT ON universe.planets TO 'user1'@'localhost'; ~!@// grant@!~
REVOKE SELECT ON universe.planets FROM 'user1'@'localhost'; ~!@// revoke@!~
```
-------------------------------------------------------------
`GRANT` statement allocates privileges to `TiDB` users or roles. The privilege system in `TiDB` follows `MySQL`, where credentials are assigned based on a database/table pattern. Executing this statement requires the `GRANT OPTION` privilege and all privileges you allocate.

Similar to `MySQL`, the `USAGE` privilege denotes the ability to log into a `TiDB` server.
- Column level privileges are not currently supported.
- Similar to `MySQL`, when the `NO_AUTO_CREATE_USER sql mode` is not present, the `GRANT` statement will automatically create a new user with an empty password when a user does not exist Removing this `SQL MODE` (it is enabled by default) presents a security risk.

For detail about the `syntax` and the `{privilege_list}`, please refer to `https://docs.pingcap.com/tidb/stable/sql-statement-grant-privileges`.