Aside from basic equality, there are other spots in the aggregation grammar where a FLE-2 encrypted field could be referenced while giving correct query semantics.

1. Non-equality accumulator reference ($first, $last)
2. $push an encrypted field, but not $addToSet since it requires equality between randomly encrypted fields
3. Renaming an encrypted field (in aggregate pipeline, not update/findAndModify)
4. Branching/conditional expressions ($ifNull, $cond)