Why should you care?

A analytics service should not delete orders. Authorization enforces least privilege even after login succeeds.

See it live — copy this example

Open mongosh or MongoDB Compass, select database nosqlverse, then run the example. Change one field and run again.

use admin
db.createUser({
  user: "reporter",
  pwd: "strong-pass",
  roles: [ { role: "read", db: "NoSQLVerse" } ]
})
// As reporter:
db.orders.find().limit(1)        // ok
db.orders.insertOne({ x: 1 })  // fails unauthorized

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• read role allows queries on your database but not inserts.
• Attempting insertOne returns an unauthorized error.
• That is authorization working — identity was fine, permission was not.

Practice next

1. Create reporter with read.
2. Verify find works and insert fails.
3. Grant readWrite on a staging DB only for developers.
4. Use changePassword and updateUser roles.
5. Try read on one DB and readWrite on another for the same user.

Remember

Authorization = permissions after login. Prefer least privilege roles. Test deny paths, not only allow.

BI tool credentials

Metabase connects with a read-only Mongo user.

Outcome: A bad dashboard query cannot wipe collections.