We have test coverage in commands_builtin_roles_standalone.js (i.e. for mongod) that the cluster* commands (e.g. here) can be run by a user with the "internal" action privilege but there is currently no test that verifies that a user without the "internal" action privilege can't run these commands.