# Management Roles

__*TiDB role management*__

+ Grant Role privilege:
  + `grant select on test.* to 'r_dev'@'localhost';`

+ To grant a role to a user:
  + `grant 'r_admin' to 'user1'@'localhost';`


+ To view the privilege a role has:
  + `show grants for 'dev1'@'localhost';`

+ Reclaim role privilege:
  + `revoke insert, update, delete on test.* form 'r_dev'@'localhost';`

+ To delete a role:
  + `drop role 'r_admin', 'r_dev'@'localhost';`

-------------------------------------------------------------
1. Grant privilege roles
Grant the r_dev role read privilege to the database test:
GRANT SELECT ON test.* TO 'r_dev' @'localhost';

2. Granting Roles to Users
Grant the r_admin role to user 'user1' @'localhost':
GRANT 'r_admin' TO 'user1'@'localhost';

3. View the privilege a role has
SHOW GRANTS FOR 'dev1' @'localhost';
+—+
| Grants for dev1 @localhost |
+—+
| GRANT USAGE ON *.* TO `dev1` @`localhost` |
| GRANT `app_developer` @`%` TO `dev1` @`localhost` |
+—+

4. Reclaim role privilege
Reclaim write privilege under the test database for the r_dev role:
REVOKE INSERT, UPDATE, DELETE ON test.* FROM 'r_dev' @'localhost';

5. Deleting a role
DROP ROLE 'r*admin', 'r*dev' @'localhost';

For detailed operation, please refer to: https://docs.pingcap.com/zh/tidb/stable/role-based-access-control