That's precisely how Meteor auth works. Each client can request a set of documents from the server -- think of it as a predefined query. For each of those requests, your server code decides what (if anything) to send back to the client.