Major - P3 The audit record lists all the privileges the role has, not just the granted ones.
Here's BSON format
{u'remote': {u'ip': u'127.0.0.1', u'port': 44284}, u'users': [{u'userSource': u'admin', u'user': u'admin'}], u'atype': u'grantPrivilegesToRole', u'ts': datetime.datetime(2013, 11, 1, 16, 51, 51, 37000, tzinfo=<bson.tz_util.FixedOffset object at 0x238da50>), u'param': {u'db': u'roledb34', u'privileges': [{u'resource': {u'db': u'roledb34', u'collection': u'thrip'}, u'actions': [u'createRole', u'createUser', u'dropUser']}, {u'resource': {u'db': u'admin', u'collection': u''}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.indexes'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.js'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}, {u'resource': {u'db': u'admin', u'collection': u'system.namespaces'}, u'actions': [u'collStats', u'dbHash', u'dbStats', u'find', u'killCursors']}], u'role': u'role36'}, u'result': 0, u'local': {u'ip': u'127.0.0.1', u'port': 27017}}
Here's text format.
2013-11-01T12:58:02.636-0400 admin@admin 127.0.0.1:44302/127.0.0.1:27017 Granted to role role72@roledb70 the privileges: { resource: { db: "roledb70", collection: "thrip" }, actions: [ "createRole", "createUser", "dropUser" ] }, { resource: { db: "admin", collection: "" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.indexes" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.js" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }, { resource: { db: "admin", collection: "system.namespaces" }, actions: [ "collStats", "dbHash", "dbStats", "find", "killCursors" ] }.
RemovePrivileges has the same problem. That's even worse — it lists as removed all the aspects of the role EXCEPT those which were removed.