Writes to the admin.system.roles and maybe admin.system.users and admin.system.version collections need to be serialized, because the role graph and user cache maintenance code depends on that behavior. The actual user and role management commands are fine, because they are externally synchronized, but direct writes to the roles collection, say by mongorestore, need to be synchronized.

The easiest solution is to make all writes to the admin database require a MODE_X lock on the admin database.