The connector currently requires cluster-wide "find" and "changeStream" permissions to be able to start. It could make it impossible to use the connector due to security policies of an company.

Do not require cluster-wide permissions when watching just a single collection or database to make it possible/easier to comply with security policies. The Change Stream can be opened with permissions just for a collection or for a database. Note that the official MongoDB connector doesn't require cluster-wide permissions.