MongoDB Documentation, Release 3.0.4 Administrators also can create new roles and privileges to cater to operational needs. Administrators can assign privileges scoped as granularly as the collection level. When granted a role, a user receives all the privileges of that role. A user can have several roles concurrently, in which case the user receives the union of all the privileges of the respective roles. A role consists of privileges that pair resources with allowed operations. Each privilege is defined directly in the role or inherited from another role. A role’s privileges apply to the database where the role is created. A role created on the admin database can include privileges that apply to all databases or to the cluster (page 418). A user assigned a role receives all the privileges of that role. The user can have multiple roles and can have different roles on different databases. Roles always grant privileges and never limit access. For example, if a user has both read (page 405) and readWriteAnyDatabase (page 412) roles on a database, the greater access prevails. Roles Privileges A privilege consists of a specified resource and the actions permitted on the resource. A privilege resource (page 417) is either a database, collection, set of collections, or the cluster. If the cluster, the affiliated actions affect the state of the system rather than a specific database or collection. An action (page 419) is a command or method the user is allowed to perform on the resource. A resource can have multiple allowed actions. For available actions see Privilege Actions (page 419). For example, a privilege that includes the update (page 419) action allows a user to modify existing documents on the resource. To additionally grant the user permission to create documents on the resource, the administrator would add the insert (page 419) action to the privilege. For privilege syntax, see admin.system.roles.privileges (page 414). A role can include one or more existing roles in its definition, in which case the role inherits all the privileges of the included roles. A role can inherit privileges from other roles in its database. A role created on the admin database can inherit privileges from roles in any database. Inherited Privileges User-Defined Roles New in version 2.6. User administrators can create custom roles to ensure collection-level and command-level granularity and to adhere to the policy of least privilege . Administrators create and edit roles using the role management commands . MongoDB scopes a user-defined role to the database in which it is created and uniquely identifies the role by the pairing of its name and its database. MongoDB stores the roles in the admin database’s system.roles (page 413) collection. Do not access this collection directly but instead use the role management commands to view and edit custom roles. 6.2. Security Concepts 325