I don't mind doing that, but not sure if really needed.

Eg. see https://github.com/ezsystems/ezpublish-kernel/blob/master/eZ/Publish/Core/Repository/RoleService.php#L1050. We do validate what is allowed to be used on a module/function, so it will be possible to create this limitation only with content/versionread and content/versionremove.

Also, `getCriterion` is ATM used only by SearchService to add permissions criteria, so we would need to catch instead of compare with null there, but I don't see where user could get that exception. It would be basically the same from the outside.