MongoDB: Privileges on objects created by me only?
A database does not need to exist at the time you grant a user permissions on it.

So the solution to this is simply to pre-grant a superset of all permissions you expect might be needed in the future. Then they will just sit there unless and until needed.

In my case the list of permissions needed changes fairly frequently, but the prefix-style patterns are predictable. (Namely, the user's name matches the first part of its databases' names.) So I use a config file like this, to which I add entries before they are needed. The script runs regularly, and grants new permissions, which just sit there until they are actually used.

[ { 'replica_set' : 'cluster0',
    'members' : [ 'server0', 'server1', ... 'serverN' ],
    'permissions' : [ 'user' : 'lizard_user', 'db_patterns' : [ 'lizard_' ] },
    ...
  },
  { 'replica_set' : 'cluster1',
  ...
  }
]


I'm posting this workaround primarily to note the misconception I had about granting permissions on not-yet-existent objects, in case others share it. It would still be cool if there were a privilege like 'readWriteAllMyDatabases'.