I submit for your consideration the following draft overview (as promised)

With authentication enabled, MongoDB will force all clients to
identify themselves before granting access to the
server. Authorization, in turn, allows administrators to define and
limit the resources and operations that a user can access. Using
authentication and authorization is a key part of a complete security
strategy.

All MongoDB deployments support authentication; however, MongoDB does
not enable authentication. You can enable authentication on an
existing MongoDB deployment or you can create a new deployment with
authentication enabled.

This tutorial provides a procedure for creating a new MongoDB replica
set deployment with authentication enabled using the challenge and
response authentication mechanism. Finally, the procedure concludes
with instructions for creating a minimal authorization system to
support basic operations.