Thanks @jamiltz !
I just realized I have a misunderstanding on the usage of sync_function.
sync_function is only being called when adding/modifying document, is not being called on read.
So I can simply add requireRole() in sync_function to add write permission restriction on all document. 
1 Like