GRANT SELECT
    ON CHANGE STREAM change_stream_list
        | ALL CHANGE STREAMS IN SCHEMA schema_name [, ...] }
    TO ROLE role_list

REVOKE SELECT ON CHANGE STREAM change_stream_list FROM ROLE role_list