The partial_revokes system variable controls whether privilege restrictions can be placed on accounts. partial_revokes系统变量控制是否可以对帐户施加权限限制。By default, partial_revokes is disabled and attempts to partially revoke global privileges produce an error:默认情况下，partial_revokes被禁用，尝试部分撤销全局权限会产生错误：

mysql> CREATE USER u1;
mysql> GRANT SELECT, INSERT ON *.* TO u1;
mysql> REVOKE INSERT ON world.* FROM u1;
ERROR 1141 (42000): There is no such grant defined for user 'u1' on host '%'

To permit the REVOKE operation, enable partial_revokes:要允许REVOKE操作，请启用partial_revokes：

SET PERSIST partial_revokes = ON;

SET PERSIST sets the value for the running MySQL instance. SET PERSIST设置正在运行的MySQL实例的值。It also saves the value, causing it to carry over to subsequent server restarts. 它还保存了该值，使其延续到后续的服务器重启。To change the value for the running MySQL instance without having it carry over to subsequent restarts, use the GLOBAL keyword rather than PERSIST. 要更改正在运行的MySQL实例的值而不将其转移到后续重启，请使用GLOBAL关键字而不是PERSIST。See Section 13.7.6.1, “SET Syntax for Variable Assignment”.请参阅第13.7.6.1节，“变量赋值的SET语法”。

With partial_revokes enabled, the partial revoke succeeds:启用partial_revokes后，部分撤销成功：

mysql> REVOKE INSERT ON world.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+------------------------------------------+
| Grants for u1@%                          |
+------------------------------------------+
| GRANT SELECT, INSERT ON *.* TO `u1`@`%`  |
| REVOKE INSERT ON `world`.* FROM `u1`@`%` |
+------------------------------------------+

SHOW GRANTS lists partial revokes as REVOKE statements in its output. SHOW GRANTS在其输出中将部分撤销作为REVOKE语句列出。The result indicates that u1 has global SELECT and INSERT privileges, except that INSERT cannot be exercised for tables in the world schema. 结果表明，u1具有全局SELECT和INSERT权限，但不能对world模式中的表执行INSERT。That is, access by u1 to world tables is read only.也就是说，u1对world表的访问是只读的。

The server records privilege restrictions implemented through partial revokes in the mysql.user system table. 服务器在mysql.user系统表中记录通过部分撤销实现的权限限制。If an account has partial revokes, its User_attributes column value has a Restrictions attribute:如果帐户有部分撤销，则其User_attributes列值具有Restrictions属性：

mysql> SELECT User, Host, User_attributes->>'$.Restrictions'
FROM mysql.user WHERE User_attributes->>'$.Restrictions' <> '';
+------+------+------------------------------------------------------+
| User | Host | User_attributes->>'$.Restrictions'                   |
+------+------+------------------------------------------------------+
| u1   | %    | [{"Database": "world", "Privileges": ["INSERT"]}] |
+------+------+------------------------------------------------------+

Partial revoke operations are subject to these conditions:部分撤销操作受以下条件的约束：

As mentioned previously, partial revokes of schema-level privileges appear in SHOW GRANTS output as REVOKE statements. 如前所述，模式级特权的部分撤销以REVOKE语句的形式出现在SHOW GRANTS输出中。This differs from how SHOW GRANTS represents “plain” schema-level privileges:这与SHOW GRANTS表示“普通”模式级权限的方式不同：

When a user grants a privilege, any restriction the grantor has on the privilege is inherited by the grantee, unless the grantee already has the privilege without the restriction. 当用户授予特权时，授予人对特权的任何限制都由受让人继承，除非受让人已经拥有没有限制的特权。Consider the following two users, one of whom has the global SELECT privilege:考虑以下两个用户，其中一个具有全局SELECT权限：

CREATE USER u1, u2;
GRANT SELECT ON *.* TO u2;

Suppose that an administrative user admin has a global but partially revoked SELECT privilege:假设管理用户admin具有全局但部分撤销的SELECT权限：

mysql> CREATE USER admin;
mysql> GRANT SELECT ON *.* TO admin WITH GRANT OPTION;
mysql> REVOKE SELECT ON mysql.* FROM admin;
mysql> SHOW GRANTS FOR admin;
+------------------------------------------------------+
| Grants for admin@%                                   |
+------------------------------------------------------+
| GRANT SELECT ON *.* TO `admin`@`%` WITH GRANT OPTION |
| REVOKE SELECT ON `mysql`.* FROM `admin`@`%`          |
+------------------------------------------------------+

If admin grants SELECT globally to u1 and u2, the result differs for each user:如果admin对u1和u2全局授予SELECT，则每个用户的结果都不同：

If a GRANT statement includes an AS user clause, the privilege restrictions applied are those on the user/role combination specified by the clause, rather than those on the user who executes the statement. 如果GRANT语句包含AS user子句，则应用的特权限制是对该子句指定的用户/角色组合的特权限制，而不是对执行该语句的用户的特权限制。For information about the AS clause, see Section 13.7.1.6, “GRANT Statement”.有关AS子句的信息，请参阅第13.7.1.6节，“GRANT语句”。

Restrictions on new privileges granted to an account are added to any existing restrictions for that account:对授予帐户的新特权的限制将添加到该帐户的任何现有限制中：

mysql> CREATE USER u1;
mysql> GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1;
mysql> REVOKE INSERT ON mysql.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+---------------------------------------------------------+
| Grants for u1@%                                         |
+---------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `u1`@`%` |
| REVOKE INSERT ON `mysql`.* FROM `u1`@`%`                |
+---------------------------------------------------------+
mysql> REVOKE DELETE, UPDATE ON db2.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+---------------------------------------------------------+
| Grants for u1@%                                         |
+---------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `u1`@`%` |
| REVOKE UPDATE, DELETE ON `db2`.* FROM `u1`@`%`          |
| REVOKE INSERT ON `mysql`.* FROM `u1`@`%`                |
+---------------------------------------------------------+

Aggregation of privilege restrictions applies both when privileges are partially revoked explicitly (as just shown) and when restrictions are inherited implicitly from the user who executes the statement or the user mentioned in an AS user clause.特权限制的聚合既适用于部分明确撤销特权的情况（如刚刚所示），也适用于从执行语句的用户或AS user子句中提到的用户隐式继承限制的情况。

If an account has a privilege restriction on a schema:如果帐户对架构有特权限制：

If an account has a restriction on a global privilege, the restriction is removed by any of these actions:如果帐户对全局权限有限制，则可以通过以下任何操作删除该限制：

Consider a user u1 who holds several privileges globally, but with restrictions on INSERT, UPDATE and DELETE:考虑一个用户u1，他在全局拥有多个权限，但对INSERT、UPDATE和DELETE有限制：

mysql> CREATE USER u1;
mysql> GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO u1;
mysql> REVOKE INSERT, UPDATE, DELETE ON mysql.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+----------------------------------------------------------+
| Grants for u1@%                                          |
+----------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `u1`@`%`  |
| REVOKE INSERT, UPDATE, DELETE ON `mysql`.* FROM `u1`@`%` |
+----------------------------------------------------------+

Granting a privilege globally to u1 from an account with no restriction removes the privilege restriction. For example, to remove the INSERT restriction:从没有限制的帐户全局授予u1特权会删除特权限制。例如，要删除INSERT限制：

mysql> GRANT INSERT ON *.* TO u1;
mysql> SHOW GRANTS FOR u1;
+---------------------------------------------------------+
| Grants for u1@%                                         |
+---------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `u1`@`%` |
| REVOKE UPDATE, DELETE ON `mysql`.* FROM `u1`@`%`        |
+---------------------------------------------------------+

Granting a privilege at the schema level to u1 removes the privilege restriction. 在架构级别向u1授予特权会消除特权限制。For example, to remove the UPDATE restriction:例如，要删除UPDATE限制：

mysql> GRANT UPDATE ON mysql.* TO u1;
mysql> SHOW GRANTS FOR u1;
+---------------------------------------------------------+
| Grants for u1@%                                         |
+---------------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE, DELETE ON *.* TO `u1`@`%` |
| REVOKE DELETE ON `mysql`.* FROM `u1`@`%`                |
+---------------------------------------------------------+

Revoking a global privilege removes the privilege, including any restrictions on it. 撤销全局特权会删除特权，包括对它的任何限制。For example, to remove the DELETE restriction (at the cost of removing all DELETE access):例如，要删除DELETE限制（以删除所有DELETE访问为代价）：

mysql> REVOKE DELETE ON *.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+-------------------------------------------------+
| Grants for u1@%                                 |
+-------------------------------------------------+
| GRANT SELECT, INSERT, UPDATE ON *.* TO `u1`@`%` |
+-------------------------------------------------+

If an account has a privilege at both the global and schema levels, you must revoke it at the schema level twice to effect a partial revoke. 如果一个帐户在全局和架构级别都有特权，则必须在架构级别撤销两次才能实现部分撤销。Suppose that u1 has these privileges, where INSERT is held both globally and on the world schema:假设u1具有这些特权，其中INSERT在全局和world模式上都有：

mysql> CREATE USER u1;
mysql> GRANT SELECT, INSERT ON *.* TO u1;
mysql> GRANT INSERT ON world.* TO u1;
mysql> SHOW GRANTS FOR u1;
+-----------------------------------------+
| Grants for u1@%                         |
+-----------------------------------------+
| GRANT SELECT, INSERT ON *.* TO `u1`@`%` |
| GRANT INSERT ON `world`.* TO `u1`@`%`   |
+-----------------------------------------+

Revoking INSERT on world revokes the schema-level privilege (SHOW GRANTS no longer displays the schema-level GRANT statement):撤销world上的INSERT将撤销架构级权限（SHOW GRANTS不再显示架构级GRANT语句）：

mysql> REVOKE INSERT ON world.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+-----------------------------------------+
| Grants for u1@%                         |
+-----------------------------------------+
| GRANT SELECT, INSERT ON *.* TO `u1`@`%` |
+-----------------------------------------+

Revoking INSERT on world again performs a partial revoke of the global privilege (SHOW GRANTS now includes a schema-level REVOKE statement):再次撤销world上的INSERT会部分撤销全局权限（SHOW GRANTS现在包含一个模式级REVOKE语句）：

mysql> REVOKE INSERT ON world.* FROM u1;
mysql> SHOW GRANTS FOR u1;
+------------------------------------------+
| Grants for u1@%                          |
+------------------------------------------+
| GRANT SELECT, INSERT ON *.* TO `u1`@`%`  |
| REVOKE INSERT ON `world`.* FROM `u1`@`%` |
+------------------------------------------+

To provide access to accounts for some schemas but not others, partial revokes provide an alternative to the approach of explicitly granting schema-level access without granting global privileges. The two approaches have different advantages and disadvantages.为了为某些模式而不是其他模式提供对帐户的访问，部分撤销提供了一种替代方法，可以在不授予全局权限的情况下显式授予模式级访问权限。这两种方法各有优缺点。

Granting schema-level privileges and not global privileges:授予架构级别权限而非全局权限：

Granting global privileges in conjunction with partial revokes:授予全局权限并同时进行部分撤销：

The approach that uses explicit schema-level grant is more convenient for accounts for which access is limited to a few schemas. The approach that uses partial revokes is more convenient for accounts with broad access to all schemas except a few.对于访问权限仅限于少数模式的帐户，使用显式模式级授权的方法更方便。使用部分撤销的方法对于可以广泛访问除少数模式之外的所有模式的帐户来说更方便。

Once enabled, partial_revokes cannot be disabled if any account has privilege restrictions. 一旦启用，如果任何帐户有权限限制，则无法禁用partial_revokes。If any such account exists, disabling partial_revokes fails:如果存在任何此类帐户，则禁用partial_revokes失败：

To disable partial_revokes when restrictions exist, the restrictions first must be removed:要在存在限制时禁用partial_revokes，必须首先删除限制：

After all privilege restrictions are removed, it is possible to disable partial revokes:删除所有特权限制后，可以禁用部分撤销：

SET PERSIST partial_revokes = OFF;

In replication scenarios, if partial_revokes is enabled on any host, it must be enabled on all hosts. 在复制场景中，如果在任何主机上启用了partial_revokes，则必须在所有主机上启用它。Otherwise, REVOKE statements to partially revoke a global privilege do not have the same effect for all hosts on which replication occurs, potentially resulting in replication inconsistencies or errors.否则，用于部分撤销全局权限的REVOKE语句对发生复制的所有主机没有相同的效果，可能会导致复制不一致或错误。