Right now there's some confusion between high cardinality/low selectivity and what that mode actually means for the server-side rewrite. This ticket will rename the mode to EncryptedCollScanMode to be more explicit about what the modes actually do: Rewriting to a $in makes use of the underlying multikey btree index on safecontent, while generating tags at runtime will answer the query with a column scan.