Actually, it was impossible to restrict updates when the screencast was made -- the Meteor "auth" system just landed a few months ago, and now it's possible. (

Actually, it was impossible to restrict updates when the screencast was made -- the Meteor "auth" system just landed a few months ago, and now it's possible. (You can provide your own update methods that do authentication before proceeding, and then disable the direct Mongo updates.)