There is nothing special about the user
root is normally granted
WITH GRANT OPTION, and doing it
ON *.* thereby providing all the nasty things you should give to non-root users. But all this is a convention.
Often an application is given
GRANT ALL PRIVILEGES
ON db_app.* -- limited to the app's database
TO app@'...' -- '%' is scary, but may be necessary
-- but no `WITH GRANT OPTION`.
This would give you "admin" as much privilege as normally given just to
GRANT ALL PRIVILEGES ON *.* TO admin@'%' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON *.* TO admin@'localhost' WITH GRANT OPTION;
% does not include
localhost. This is an important security point.
It is probably better to give only this to
root (or your
GRANT ALL PRIVILEGES ON *.* TO root@'localhost' WITH GRANT OPTION;
That is, not also exposed to the outside world. This gives you a layer of protection by forcing
root to first log into the server, and only then can he get into mysql with full privileges.