I wrote a tool that idempotently applied group and user permissions in MySQL 5.7 with transactions using OpenBSD's pf configuration syntax.

A year later GCP patched MySQL to block access to the security tables, so I could no longer use the tool. Big bummer on that one.

But it was quite a beauty while it existed.