DOCS-1007: additional clarification

Author: Sam Kleinman

source/administration/sharded-clusters.txt

@@ -322,13 +322,18 @@ different locations within the cluster and have different roles:
   connected to a :program:`mongos` instance using the :term:`admin
   database`.
 
+- Each shard has its own :term:`admin database`, which stores
+  administrative credentials and access for that shard only.
+
 - Other database credentials reside on the *primary* shard for the
   database.
 
 This means that you *can* authenticate to these users and databases
-while connected directly to the *primary* shard for a database. However,
-for clarity and consistency all interactions between the client and
-the database should use a :program:`mongos` instance.
+while connected directly to the *primary* shard for a database. You
+**cannot** authenticate to a database in a sharded cluster that is not
+the primary for that database. However, for clarity and consistency
+all interactions between the client and the database should use a
+:program:`mongos` instance.
 
 .. note::