Watch this video on YouTube
Cosmos DB uses a primary key model to give people full control over a Cosmos DB account. How do you limit someone to having only read-only access to your database?