Access control (also referred to as authorization) defines and enforces what actions a database user is allowed to perform once authenticated. Access control follows authentication: you cannot have one without the other! As you may recall from our previous discussion, authentication is the process of determining the identity of a user. Access control, on the other hand, determines what the user can do.
You establish access control over one or more databases by assigning privilege actions (https://docs.mongodb.com/manual/reference/privilege-actions/#privilege-actions) to roles. Privileges fall into three general categories: CRUD (Create Read Update Delete) operations, Database Management (for example, managing database users), and Infrastructure Management (for example, replication and sharding operations).