generateContent. I want to make this action private so that only the registry server can invoke it, and no clients can call this action directly. However, I still want clients to be able to subscribe to this actor without having permission to invoke the generateContent action.apiKey approach to restrict access, but I am looking for a better or more secure way to achieve this.