This is really a subset of the problem discussed at https://www.discovermeteor.com/blog/reactive-joins-in-meteor/. I’m a fan of using the reywood:publish-composite package for this particular use case. For example, if the user’s access was determined by some attribute set on the user document, you could try this:
When the user document is updated (i.e. when the cursor results from the first find changes), then the child find (and the hasAccessToTask function) is re-run and the old publication is stopped.