Foreign key without read permission

I see I could usee the entity service to do something in the controller backed of roomSession but it just produces a draft and not publish it