# Atlas Access Control and RBAC > Source-anchored research for Atlas Access Control and RBAC. Run status: COMPLETED. Parent: [MongoDB Compliance and Regulatory](https://llms-explorer.com/tree/mongodb-compliance-and-regulatory/) · 3 facets · 13 facts · page: https://llms-explorer.com/tree/atlas-access-control-and-rbac/ ## How it works - Atlas database users are separate from Atlas application users. Management roles govern Atlas UI/API actions, while database roles determine access when clients connect to clusters. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md) - Atlas recommends assigning the minimum required permissions and using fine-grained custom database roles when predefined privileges are too broad; those roles can scope actions to particular databases and collections. (high confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md) - An Atlas custom role that grants insert can permit collection creation even when CREATE_COLLECTION is absent. A Terraform report reproduced this behavior, and the MongoDB privilege reference lists create among commands authorized by insert. (high confidence) — [source](https://github.com/mongodb/terraform-provider-mongodbatlas/issues/1963) ## Problems, failure modes and limitations - Atlas custom-role actions cover a subset of the actions available to built-in roles; a custom role cannot be assumed to reproduce every built-in capability. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-add-mongodb-roles.md) ## Facts and statements - Database role grants combine: Atlas applies custom roles together with built-in roles and directly assigned privileges, and a more restrictive role does not cancel a higher permission granted by another role. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-add-mongodb-roles.md) - Atlas database users can access all clusters and federated database instances in their project by default; administrators can restrict a user to selected instances. Resource scoping must therefore be reviewed separately from role selection. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md) - Atlas requires database users and roles to be managed through the Atlas UI, Atlas CLI, Atlas Administration API, or a supported integration; otherwise Atlas rolls back those modifications. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md) - Atlas supports temporary database users that expire automatically, making time-bounded access possible without leaving permanent database credentials. (high confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/auth/authorization.md) - In Terraform issue 1522, assigning a custom role against an application database produced HTTP 400 UNSUPPORTED_ROLE. Setting roles.database_name to admin fixed the assignment; the custom role resource still defined the actual database and collection privileges. Maintainers documented this distinction in January 2024. (low confidence) — [source](https://github.com/mongodb/terraform-provider-mongodbatlas/issues/1522) - Atlan documents a metadata-crawling custom role using listDatabases, sqlGetSchema, dbStats, listCollections, and collStats. Its JDBC validation also requires find, which its recipe scopes to a nonexistent collection to avoid reading existing collection contents. This is connector-specific guidance, not a universal Atlas requirement. (low confidence) (verified as of 2026-10-23) — [source](https://docs.atlan.com/apps/connectors/database/mongodb/how-tos/set-up-mongodb) - Atlas can combine a built-in role, multiple custom roles, and specific privileges for one database user; specific privileges can target individual databases and collections. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md) - HashiCorp provides an Atlas-specific Vault database plugin that generates unique, ephemeral database-user credentials from configured roles. (high confidence) — [source](https://developer.hashicorp.com/vault/api-docs/secret/databases/mongodbatlas) - The Vault Atlas database plugin accepts role assignments and a scopes array in creation statements. If scopes is omitted, the plugin defaults to all scopes, so credential automation must explicitly preserve intended deployment restrictions. (high confidence) — [source](https://developer.hashicorp.com/vault/api-docs/secret/databases/mongodbatlas)