Foreign key without read permission

i have the table session with columns:
id (the default primary key), ip, startDate, endDate, userAgent, uuid
The table room with columns:
id (the default primary key), name
And the table roomSession wih columns:
id (the default primary key), session (foreign key), room (foreign key), startDate, endDate, uuid

The session and roomSession allow anonymous users to just create things and not read anything meanwhile the room table can be read by everyone.
How do I do so that when I insert a roomSession it can do the reference to session correctly?

This topic has been created from a Discord post (1278282017519435776) to give it more visibility.
It will be on Read-Only mode here.
Join the conversation on Discord

I see I could usee the entity service to do something in the controller backed of roomSession but it just produces a draft and not publish it