In MySQL, possessing a privilege and being allowed to delegate it are separate capabilities. Add WITH GRANT OPTION to the grant at the required scope, then inspect the server’s stored privileges instead of trusting a user-interface checkbox.
Last updated: October 14, 2026.
GRANT SELECT, INSERT
ON app_reporting.*
TO 'report_admin'@'10.20.%'
WITH GRANT OPTION;
SHOW GRANTS FOR 'report_admin'@'10.20.%';The expected output should include WITH GRANT OPTION on the database-level grant. Use the exact account name and host part because report_admin@localhost and [email protected].% are different accounts.
Grant delegation at the narrowest scope
The MySQL GRANT reference states that WITH GRANT OPTION lets an account grant its privileges to other accounts at that privilege level. Prefer a database, table, or routine scope instead of *.*, and grant only the operations that the delegated administrator must manage.
The account issuing the statement must itself possess both the privileges being delegated and the grant option for them. Do not work around an authorization failure by editing MySQL system tables directly.
Verify after every administrative change
MySQL documents SHOW GRANTS as the server-generated statements representing an account’s explicit privileges and roles. Run it after changes made through phpMyAdmin, hosting panels, automation, or SQL scripts. Also check active roles when access is inherited rather than granted directly.
When a control panel appears to save a grant but SHOW GRANTS omits it, preserve the generated SQL and server version, then apply a reviewed statement directly with an account authorized to delegate. Recheck the result from a fresh authenticated session. This separates a management-interface defect from a server authorization failure.
GRANT OPTION is powerful: a delegated user can pass along privileges it holds at that scope. Review it periodically, restrict administrative connection hosts, and use separate application and administration accounts. Revoke delegation when the workflow no longer requires it, without removing unrelated privileges.
Continue with MySQL authentication errors, upgrade preflight checks, and designing application roles and permissions.
