The information about grants is not as clear as it could be here: https://mariadb.com/kb/en/mariadb-enterprise/mariadb-maxscale/setting-up-maxscale/

If the binlog router is being used then it's likely that the binlog router is on a different server to the backend "master". It's also possible that you have a cluster of binlog routers to provide HA functionality so there won't be a single server. It may be worth mentioning this and how this setup might work.

Also show "just the grants" as it's easier to read then each statement, so something like:

– Grants for auth user (to get grants)
CREATE USER 'auth_user'@'somewhere' IDENTIFIED BY 'xxxxxx';
GRANT SHOW DATABASES ON . TO 'auth_user'@'somewhere';
GRANT SELECT ON `mysql`.`db` TO 'auth_user'@'somewhere';
GRANT SELECT ON `mysql`.`tables_priv` TO 'auth_user'@'somewhere';
GRANT SELECT ON `mysql`.`user` TO 'auth_user'@'somewhere';

– Replication slave access (for maxscale to download binlogs)
CREATE USER 'slave_user'@'somewhere' IDENTIFIED BY 'xxxxx';
GRANT REPLICATION SLAVE ON . TO 'slave_user'@'somewhere';

This format is easier to put into a template for generating automatically.

Note: 'somewhere' is unlikely to be a single hostname or ip address but maybe using a wild-card entry like '192.168.5.%' as if you use specific hostnames/ips you'll need to add an entry for each host and that may be cumbersome.