Comment by tracker1

How does your example prevent someone with access to your meteor server from bypassing your custom permissions? My understanding is the code in question runs on the client.