"binding" (or "auto") requires that the user has access (canRead() ) to all returned data. If that is not the case, an UnauthorizedException is raised.

"filter" filters out the results for which canRead() is false.