According to the documentation, the following commands accept the bypassDocumentValidation option:

• aggregate
• applyOps
• cloneCollection on the destination collection
• clone on the destination
• copydb on the destination
• findAndModify
• insert
• mapReduce
• update

However, there are no tests in the commands lib that exercise the logic that enforces the bypassDocumentValidation authz action on the namespace being written to. We should address the coverage gap!