Give a role access to a function without giving it read access to the whole collection

@rova, you may want to upvote his feature request: