Authentication Restrictions can be attached to roles. This is necessary for externally authorized users, which do not have user document representations in MongoDB. When a user authenticates, its authorization restrictions are checked. It can authenticate if its restrictions are met, and ever restriction attached to inherited roles are met.

The syntax for createRole and updateRole is identical to that of createUser and updateUser.