Every database engine assumes that not everyone who connects should be able to do everything. User accounts identify who is connecting, privileges define what each account is allowed to do, and roles bundle privileges into reusable packages that can be granted and revoked as job responsibilities change. In this topic you will look at how accounts are created with CREATE USER, how access rights are assigned with GRANT and withdrawn with REVOKE, and how a role-based access control (RBAC) model keeps permission management manageable as the number of users grows.
Two ideas sit underneath the mechanics. The principle of least privilege says each account should hold only the rights it needs for its task and nothing more, so that a compromised or careless account causes limited damage. Separation of duties says that sensitive combinations of power — for example, the ability to both change data and erase the audit trail of that change — should not sit in a single role, and that administrative accounts should be distinct from everyday application accounts.
The videos below approach this from two directions: one conceptual video on access control models, and two hands-on walkthroughs in MySQL and Oracle. While watching the conceptual video, pay attention to how roles differ from attribute-based rules and when each approach fits. While watching the hands-on videos, note the exact syntax for creating an account, the difference between creating a user and granting that user any privileges, and how the demonstrated grants would change if you deliberately restricted them to the minimum needed.
An IBM Technology explainer that contrasts role-based access control with attribute-based access control. Expect a definition of RBAC in terms of roles, permissions assigned to roles, and users assigned to roles, followed by ABAC's use of attributes such as user, resource, and environment characteristics to evaluate access decisions, along with trade-offs between the two models.
It gives you the vocabulary and the mental model behind roles before you start typing GRANT statements, and it comes from a producer with a strong track record for clear, accurate security explainers.
A short Database Star tutorial on creating a new user account in MySQL. It is likely to cover the CREATE USER statement, how MySQL identifies accounts by username and host, setting a password, and then granting privileges to the new account so it can actually do useful work.
It turns the abstract idea of a user account into concrete, runnable syntax in a widely used open-source DBMS, and it highlights the important point that creating a user and granting privileges are two separate steps.
A Database Star walkthrough of creating a user in Oracle Database. Expect coverage of the CREATE USER statement along with Oracle-specific considerations such as pluggable databases and common versus local users, default tablespaces, and the grants (for example CREATE SESSION) a new account needs before it can connect and work.
Seeing the same task in a second engine shows which concepts are universal and which are vendor-specific, which is exactly the judgment you need when applying least privilege in an unfamiliar system.
Together these videos support MO1 by framing why access should be constrained at all and giving you the role-centered vocabulary that least privilege is expressed in, and they most directly support MO2 by demonstrating the concrete account-creation and privilege-granting steps in MySQL and Oracle that you will extend into roles, GRANT and REVOKE statements, and separation-of-duties configurations. The least-privilege thinking reinforced here also underpins MO4, since a secure application-to-database connection depends on a service account that holds only the rights the application actually uses; the module's other materials and your lab work will carry the remaining outcomes on parameterized queries (MO3) and connection pooling risks (MO5).
These videos were chosen from YouTube on October 2, 2026. Each has captions; the player turns them on. Videos on YouTube can be changed or removed — if one no longer plays, tell your instructor. If a player does not appear, use its Watch on YouTube link.