In our documentation for Compass, there is no reference to required permission for Compass to work. The issue in particular is applicable to Compass 1.2.0. Here is the error:

I ACCESS   [conn19157] Unauthorized: not authorized on db to execute command { aggregate: "collname", pipeline: [ { $indexStats: {} }, { $project: { name: 1, usageHost: "$host", usageCount: "$accesses.ops", usageSince: "$accesses.since" } } ] }

In this case the user has the built in role for read but also needs the privilege for indexStats

We should follow up with the compass team to verify those are the only permissions needed now for Compass.