Currently, commands for manipulating sharding information about a collection (shardCollection, moveChunk, splitChunk, etc.) require privileges on the cluster resource. This means that you can only grant users the ability to shard all collections or none, there's no way to say you can shard collections in this db but not collections in this other db. If we change the access control checks in these commands to use the namespace as the target, this should be easy to fix.