AAS permissions for Power BI Live Connection

Say [User A] needs to see a Power BI Report, [MyCubeBasedReport] that connects via Live Connection to an AAS Cube, [MyCube]

• [User A] needs at least Viewer permissions in the Workspace containing [MyCubeBasedReport]
• But then [User A] also needs Read permission on any tables/columns in [MyCube] that are used in [MyCubeBasedReport]'s Visuals.
  • That seems like a bummer.
  • Say I don't want [UserA] to be able to connect to TimesheetTable and get all the details, as that'd expose salaries. But I do want them to be able to view Measures that rely on those columns in TimesheetTable. In [MyCubeBasedReport] it's all rolled up, so fine. But to let them see the rolled up data, I have to give them access to the relevant columns in the TimesheetTable in the Cube - then they could just fire up Power BI, connect, and see the entire column.  The only solution being to anonomymize this hypothetical Timesheet table, by putting a restriction on the person.

Am I missing something?