MongoDB Documentation, Release 3.0.4 The following role provides full privileges on all resources: Provides access to the operations and all the resources of the readWriteAnyDatabase (page 412), dbAdminAnyDatabase (page 412), userAdminAnyDatabase (page 412) and clusterAdmin (page 408) roles combined . root (page 413) does not include any access to collections that begin with the system. prefix. For example, without the ability to insert data directly into the:data: system.users <admin.system.users> and system.roles (page 291) collections in the admin database. root (page 413) is not suitable for writing or restoring data that have these collections (e.g. with mongorestore .) To perform these kinds of restore operations, provision users with the restore (page 411) role. MongoDB assigns this role to user objects that represent cluster members, such as replica set members and mongos instances. The role entitles its holder to take any action against any object in the database. Do not assign this role to user objects representing applications or human administrators, other than in excep- tional circumstances. If you need access to all actions on all resources, for example to run applyOps commands, do not assign this role. Instead, create a user-defined role (page 388) that grants anyAction (page 424) on anyResource (page 419) and ensure that only the users who need access to these operations have this access. New in version 2.6. The system.roles collection in the admin database stores the user-defined roles. To create and manage these user-defined roles, MongoDB provides role management commands . The documents in the system.roles collection have the following schema: { _id: <system-defined id>, role: "<role name>", db: "<database>", privileges: [ { resource: { <resource> }, actions: [ "<action>", ... ] }, ... ], roles: 6.4. Security Reference 413 root Internal Role __system system.roles Collection system.roles Schema • dbOwner (page 407) role, when scoped to the admin database • userAdmin (page 407) role, when scoped to the admin database • userAdminAnyDatabase (page 412) role