How can I show only those subscriptions where the user is allowed to access the source document?

I'm a little surprised that this is not the default behaviour for multi-company setups.

I'd like to allow a group of users to look at "their" subscriptions (recurring invoices), i.e. subscriptions where the source document (invoice) belongs to their company (or one of their companies, or blank).

I've given them the tools menu, Read permission on subscription, subscription document, subscription history and ir.cron. Now they see all subscriptions, and when they try to export them incl. the "Source Document" field, there's an Access Denied on the invoices (source documents) they don't have access to. By the way, this exception is not shown to the user, clicking "Export" just seemingly does nothing.

"doc_source" of  a subscription is a fields.reference, not an invoice, and I don't know how to set up the corresponding rule that resolves the reference to look at the invoice. I'd like to achieve this without creating a new addon.