When I have managed replicas, I always set this on the replica:

SET GLOBAL read_only=ON, super_read_only=ON;

Of course the replication thread gets to ignore this. But it ensures that all user requests (even superuser requests) cannot make out-of-band changes.

When I have managed replicas, I always set this on the replica:

SET GLOBAL read_only=ON;

Of course the replication thread gets to ignore this. But it ensures that all user requests (even superuser requests) cannot make out-of-band changes.

A user with SUPER privilege can still write changes on the replica even if read_only is enabled. Don't grant SUPER privilege to users.

On MySQL, you can solve this with:

SET GLOBAL read_only=ON, super_read_only=ON

But a user with SUPER privilege could get around that because they can change the setting.

The larger problem is if you can't trust the users to whom you grant SUPER privilege.