Mongo db custom role with different privilages on differenct collections
The only solution is to move that col1 to different DB, but then your application must, of course, read two different databases.