# "not authorized on admin to execute command"

Full text: `MongoServerError: not authorized on admin to execute command { [command] }`. Auth succeeded; authorization failed. This is a role problem, not a password problem.

## Confirm

1. Read the command name inside the braces. That is the privilege you lack.
2. Check the user's roles: Security, Database Access, the user, Database User Privileges.
3. Common mismatches: a `readWrite` user running `db.runCommand({ping...})` on admin is fine, but `createIndex` needs `dbAdmin` on that database, `killOp` needs `killOpSession`, sharding commands need `enableSharding` or `atlasAdmin`, and anything touching `admin` directly usually needs a broader role.

## Fix

Widen deliberately to the role the command needs, per the built-in roles table. Do not jump straight to `atlasAdmin` for an app service; grant the narrow role and retest. For one-off admin work, use a separate admin user instead of widening the app user.

## Verify

Re-run the exact failing command. It should succeed, and a command you intentionally left out of scope should still fail. That confirms the boundary is where you think it is.