The privileges required to perform a $out should depend on the mode:

• "replaceCollection" requires the "remove" and "insert" actions on the output namespace.
• "replacedocuments" requires the "update" and "insert" actions.
• "insertDocuments" requires only the "insert" action.