For the permission compatibility check, it is safe to skip the permissions required only by new aggregation stages that are not present in the previous release. SERVER-63748 has made the compatibility check ignore privileges introduced by new aggregation stages. Specifically, it made the script ignore every "privilege" that is associated with an agg_stage not present in the old IDL (e.g. here). However, beside privileges, there are also access checks (defined here). Likewise, access checks that are introduced by new aggregate stages should also be ignored in the compatibility check. This is required by SERVER-68757 which will add a new aggregation stage that internally runs a find command which sometimes requires getMore commands, and therefore requires the check_cursor_session_privilege access check.