MongoDB Documentation, Release 3.0.4 Examples Consider the following sample documents found in system.roles collection of the admin database. A User-Defined Role Specifies Privileges The following is a sample document for a user-defined role appUser defined for the myApp database: The privileges array lists the five privileges that the appUser role specifies: As indicated by the empty roles array, appUser inherits no additional privileges from other roles. User-Defined Role Inherits from Other Roles The following is a sample document for a user-defined role appAdmin defined for the myApp database: The document shows that the appAdmin role specifies privileges as well as inherits privileges from other roles: 415 6.4. Security Reference { _id: "myApp.appAdmin", role: "appAdmin", db: "myApp", privileges: [ { resource: { db: "myApp", collection: "" }, actions: [ "insert", "dbStats", "collStats", "compact", "repairDatabase" ] } ], roles: [ { role: "appUser", db: "myApp" } ] } { _id: "myApp.appUser", role: "appUser", db: "myApp", privileges: [ { resource: { db: "myApp" , collection: "" }, actions: [ "find", "createCollection", "dbStats", "collStats" ] }, { resource: { db: "myApp", collection: "logs" }, actions: [ "insert" ] }, { resource: { db: "myApp", collection: "data" }, actions: [ "insert", "update", "remove", "compact" ] }, { resource: { db: "myApp", collection: "system.js" }, actions: [ "find" ] }, ], roles: [] } • The first privilege permits its actions ( "find" , "createCollection" , "dbStats" , "collStats" ) on all the collections in the myApp database excluding its system collections. See Specify a Database as Resource (page 418). • The next two privileges permits additional actions on specific collections, logs and data , in the myApp database. See Specify a Collection of a Database as Resource (page 417). • The last privilege permits actions on one system collections (page 291) in the myApp database. While the first privilege gives database-wide permission for the find action, the action does not apply to myApp ‘s system collections. To give access to a system collection, a privilege must explicitly specify the collection. See Resource Document (page 417).