As per documentation, it is mentioned :
Change Data Capture(CDC) respects your org’s field-level security settings. Delivered events contain only the fields that a subscribed user is allowed to view. Before delivering a change event for an object, the subscribed user’s field permissions are checked. If a subscribed user has no access to a field, the field isn’t included in the change event message that the subscriber receives.
Highlighted lines are confusing because of my limited understanding of CDC. what i think, it(CDC) publishes information in event bus via some channel. if information is published, it is published including whatever fields are changed. Now there could be multiple subscriber of that stream. What I failed to understand, how subcribed user's permissions are checked?
for e.g. let say we're using native connecter in Mulesoft to subscribe to one of such channel and it then send the information to some external system. Would this mean, such connector won't able to get those changed fields for which corresponding user(used by connector) has no access ?
if that is true, even then it is unclear, what is meant by statement "...field isn’t included in the change event message that the subscriber receives"