## TL;DR

Use them before inventing workarounds. - SCRAM is the auth mechanism. When a key leaks or a service is retired, you revoke one user instead of rotating a shared credential. - Start with the narrowest role that works.

## Steps

1. - One user per service, named after the service. When a key leaks or a service is retired, you revoke one user instead of rotating a shared credential.
- Start with the narrowest role that works. A `not authorized` error tells you exactly which privilege is missing; widen deliberately, not by jumping to atlasAdmin.
- Custom roles exist for fine-grained needs (a user that can read one collection and write another). Use them before inventing workarounds.
- SCRAM is the auth mechanism. Special characters in passwords must be URL-encoded in the connection string.

2. After creating the user, connect with its credentials and run one representative write and one admin command you expect to fail. The failure confirms the boundary is real.

## When to use

You are seeing this: Database users are separate from your Atlas login. Use this skill when you run into "MongoDB Atlas: database users and least-privilege roles".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.