Hello, The "percona::rights" definie is creating the grants with the "Grant option" privilege when setting "priv => 'all'" This is IMHO wrong and not what the user wants. The GRANT option privileges should be explicitly asked and not set by default