MongoDB Documentation, Release 3.0.4 To display the privileges granted to the user by the readWrite role on the "accounts" database, issue: use accounts db.getRole( "readWrite", { showPrivileges: true } ) Step 3: Identify the privileges to grant or revoke. If the user requires additional privileges, grant to the user the role, or roles, with the required set of privileges. If such a role does not exist, create a new role (page 388) with the appropriate set of privileges. To revoke a subset of privileges provided by an existing role: revoke the original role and grant a role that contains only the required privileges. You may need to create a new role (page 388) if a role does not exist. Revoke a Role Revoke a role with the db.revokeRolesFromUser() method. The following example opera- tion removes the readWrite (page 406) role on the accounts database from the reportsUser : Grant a Role Grant a role using the db.grantRolesToUser() method. For example, the following operation grants the reportsUser user the read (page 405) role on the accounts database: For sharded clusters, the changes to the user are instant on the mongos on which the command runs. How- ever, for other mongos instances in the cluster, the user cache may wait up to 10 minutes to refresh. See userCacheInvalidationIntervalSecs . A role (page 325) grants privileges to the users who are assigned the role. Each role is scoped to a particular database, but MongoDB stores all role information in the admin.system.roles (page 291) collection in the admin database. To view a role’s information, you must be explicitly granted the role or must have the viewRole (page 420) action (page 419) on the role’s database. Chapter 6. Security 394 Overview View Roles Prerequisites use reporting db.grantRolesToUser( "reportsUser", [ { role: "read", db: "accounts" } ] ) use reporting db.revokeRolesFromUser( "reportsUser", [ { role: "readWrite", db: "accounts" } ] ) Step 4: Modify the user’s access.