diff --git a/CHANGELOG.md b/CHANGELOG.md
index 50345d27..9cf12053 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 * `crud.readview` resource cleanup on garbage collect (#379).
 * `doc/playground.lua` does not work with Tarantool 3 (#371).
 * Tests with Tarantool 3 (#364).
+* VShard storage user have not execution rights for internal functions (#366).
 
 ## [1.3.0] - 27-09-23
 
diff --git a/crud.lua b/crud.lua
index f65ae91b..d1f94560 100644
--- a/crud.lua
+++ b/crud.lua
@@ -181,7 +181,9 @@ function crud.init_storage()
     sharding_metadata.init()
     readview.init()
 
-    _G._crud.storage_info_on_storage = utils.storage_info_on_storage
+    utils.init_storage_call('storage_info_on_storage',
+        utils.storage_info_on_storage
+    )
 end
 
 function crud.init_router()
diff --git a/crud/borders.lua b/crud/borders.lua
index 68a579e1..c5114a2c 100644
--- a/crud/borders.lua
+++ b/crud/borders.lua
@@ -13,7 +13,8 @@ local BorderError = errors.new_class('BorderError', {capture_stack = false})
 
 local borders = {}
 
-local STAT_FUNC_NAME = '_crud.get_border_on_storage'
+local STAT_FUNC_NAME = 'get_border_on_storage'
+local CRUD_STAT_FUNC_NAME = utils.get_storage_call(STAT_FUNC_NAME)
 
 
 local function get_border_on_storage(border_name, space_name, index_id, field_names, fetch_latest_metadata)
@@ -43,7 +44,7 @@ local function get_border_on_storage(border_name, space_name, index_id, field_na
 end
 
 function borders.init()
-   _G._crud.get_border_on_storage = get_border_on_storage
+    utils.init_storage_call(STAT_FUNC_NAME, get_border_on_storage)
 end
 
 local is_closer
@@ -111,7 +112,7 @@ local function call_get_border_on_router(vshard_router, border_name, space_name,
         timeout = opts.timeout,
     }
     local results, err, storages_info = call.map(vshard_router,
-        STAT_FUNC_NAME,
+        CRUD_STAT_FUNC_NAME,
         {border_name, space_name, index.id, field_names, opts.fetch_latest_metadata},
         call_opts
     )
diff --git a/crud/common/sharding/sharding_metadata.lua b/crud/common/sharding/sharding_metadata.lua
index cc5a2212..f94b1463 100644
--- a/crud/common/sharding/sharding_metadata.lua
+++ b/crud/common/sharding/sharding_metadata.lua
@@ -4,6 +4,7 @@ local log = require('log')
 
 local call = require('crud.common.call')
 local const = require('crud.common.const')
+local utils = require('crud.common.utils')
 local dev_checks = require('crud.common.dev_checks')
 local router_cache = require('crud.common.sharding.router_metadata_cache')
 local storage_cache = require('crud.common.sharding.storage_metadata_cache')
@@ -13,7 +14,8 @@ local sharding_utils = require('crud.common.sharding.utils')
 
 local FetchShardingMetadataError = errors.new_class('FetchShardingMetadataError', {capture_stack = false})
 
-local FETCH_FUNC_NAME = '_crud.fetch_on_storage'
+local FETCH_FUNC_NAME = 'fetch_on_storage'
+local CRUD_FETCH_FUNC_NAME = utils.get_storage_call(FETCH_FUNC_NAME)
 
 local sharding_metadata_module = {}
 
@@ -107,7 +109,7 @@ local _fetch_on_router = locked(function(vshard_router, space_name, metadata_map
         return
     end
 
-    local metadata_map, err = call.any(vshard_router, FETCH_FUNC_NAME, {}, {
+    local metadata_map, err = call.any(vshard_router, CRUD_FETCH_FUNC_NAME, {}, {
         timeout = timeout
     })
     if err ~= nil then
@@ -213,7 +215,7 @@ function sharding_metadata_module.reload_sharding_cache(vshard_router, space_nam
 end
 
 function sharding_metadata_module.init()
-   _G._crud.fetch_on_storage = sharding_metadata_module.fetch_on_storage
+    utils.init_storage_call(FETCH_FUNC_NAME, sharding_metadata_module.fetch_on_storage)
 end
 
 return sharding_metadata_module
diff --git a/crud/common/utils.lua b/crud/common/utils.lua
index 872d716e..e128d58e 100644
--- a/crud/common/utils.lua
+++ b/crud/common/utils.lua
@@ -1,9 +1,11 @@
 local errors = require('errors')
 local ffi = require('ffi')
 local vshard = require('vshard')
+local vshard_util = require('vshard.util')
 local fun = require('fun')
 local bit = require('bit')
 local log = require('log')
+local luri = require('uri')
 
 local is_cartridge, cartridge = pcall(require, 'cartridge')
 local is_cartridge_hotreload, cartridge_hotreload = pcall(require, 'cartridge.hotreload')
@@ -27,6 +29,19 @@ local fiber = require('fiber')
 
 local utils = {}
 
+--- Returns a full call string for a storage function name.
+--
+--  @param string name a base name of the storage function.
+--
+--  @return a full string for the call.
+function utils.get_storage_call(name)
+    dev_checks('string')
+
+    return '_crud.' .. name
+end
+
+local CRUD_STORAGE_INFO_FUNC_NAME = utils.get_storage_call('storage_info_on_storage')
+
 local space_format_cache = setmetatable({}, {__mode = 'k'})
 
 -- copy from LuaJIT lj_char.c
@@ -1026,8 +1041,11 @@ function utils.update_storage_call_error_description(err, func_name, replicaset_
         return nil
     end
 
-    if err.type == 'ClientError' and type(err.message) == 'string' then
-        if err.message == string.format("Procedure '%s' is not defined", func_name) then
+    if (err.type == 'ClientError' or err.type == 'AccessDeniedError')
+        and type(err.message) == 'string' then
+        local not_defined_str = string.format("Procedure '%s' is not defined", func_name)
+        local access_denied_str = string.format("Execute access to function '%s' is denied", func_name)
+        if err.message == not_defined_str or err.message:startswith(access_denied_str) then
             if func_name:startswith('_crud.') then
                 err = NotInitializedError:new("Function %s is not registered: " ..
                     "crud isn't initialized on replicaset %q or crud module versions mismatch " ..
@@ -1113,7 +1131,7 @@ function utils.storage_info(opts)
                 status = "error",
                 is_master = replicaset.master == replica
             }
-            local ok, res = pcall(replica.conn.call, replica.conn, "_crud.storage_info_on_storage",
+            local ok, res = pcall(replica.conn.call, replica.conn, CRUD_STORAGE_INFO_FUNC_NAME,
                                   {}, async_opts)
             if ok then
                 futures_by_replicas[replica_uuid] = res
@@ -1169,6 +1187,55 @@ function utils.storage_info_on_storage()
     return {status = "running"}
 end
 
+--- Initializes a storage function by its name.
+--
+--  It adds the function into the global scope by its name and required
+--  rights to a vshard storage user.
+--
+--  @function init_storage_call
+--
+--  @param string name a name of the function.
+--  @param function func the function.
+--
+--  @return nil
+function utils.init_storage_call(name, func)
+    dev_checks('string', 'function')
+
+    rawset(_G['_crud'], name, func)
+    name = utils.get_storage_call(name)
+
+    if type(box.cfg) ~= 'table' or box.cfg.read_only then
+        -- If the storage is not configured yet then it could be
+        -- a unit-test or something else.
+        --
+        -- Anyway, it is out of scope of the call to detect and to raise an
+        -- error for the case.
+        return
+    end
+
+    local ok, storage_info = pcall(vshard.storage.info)
+    if not ok then
+        -- The storage is not configured. This is also none of our business.
+        return
+    end
+
+    local replicaset_uuid = vshard_util.replicaset_uuid()
+    local replicaset_info = storage_info.replicasets[replicaset_uuid]
+    if replicaset_info == nil or replicaset_info.master == nil then
+        -- It should not happen, but the crud could still work fine in some
+        -- configurations (Cartridge role, as example). So we just print a
+        -- warning here.
+        log.warn('Failed to find a vshard configuration for replicaset with ' ..
+            'replicaset_uuid %s. Rights to execute functions may be missed.',
+            replicaset_uuid)
+        return
+    end
+
+    local login = luri.parse(replicaset_info.master.uri).login or 'guest'
+    box.schema.func.create(name, {if_not_exists = true})
+    box.schema.user.grant(login, 'execute', 'function', name, {if_not_exists=true})
+end
+
 local expected_vshard_api = {
     'routeall', 'route', 'bucket_id_strcrc32',
     'callrw', 'callro', 'callbro', 'callre',
diff --git a/crud/count.lua b/crud/count.lua
index 8c5252e6..012517b6 100644
--- a/crud/count.lua
+++ b/crud/count.lua
@@ -17,7 +17,8 @@ local compare_conditions = require('crud.compare.conditions')
 
 local CountError = errors.new_class('CountError', {capture_stack = false})
 
-local COUNT_FUNC_NAME = '_crud.count_on_storage'
+local COUNT_FUNC_NAME = 'count_on_storage'
+local CRUD_COUNT_FUNC_NAME = utils.get_storage_call(COUNT_FUNC_NAME)
 
 local count = {}
 
@@ -86,7 +87,7 @@ local function count_on_storage(space_name, index_id, conditions, opts)
 end
 
 function count.init()
-    _G._crud.count_on_storage = count_on_storage
+    utils.init_storage_call(COUNT_FUNC_NAME, count_on_storage)
 end
 
 local check_count_safety_rl = ratelimit.new()
@@ -240,7 +241,7 @@ local function call_count_on_router(vshard_router, space_name, user_conditions,
         skip_sharding_hash_check = skip_sharding_hash_check,
     }
 
-    local results, err = call.map(vshard_router, COUNT_FUNC_NAME, {
+    local results, err = call.map(vshard_router, CRUD_COUNT_FUNC_NAME, {
         space_name, plan.index_id, plan.conditions, count_opts
     }, call_opts)
 
diff --git a/crud/delete.lua b/crud/delete.lua
index 28a7ceca..41297cf3 100644
--- a/crud/delete.lua
+++ b/crud/delete.lua
@@ -14,7 +14,8 @@ local DeleteError = errors.new_class('DeleteError', {capture_stack = false})
 
 local delete = {}
 
-local DELETE_FUNC_NAME = '_crud.delete_on_storage'
+local DELETE_FUNC_NAME = 'delete_on_storage'
+local CRUD_DELETE_FUNC_NAME = utils.get_storage_call(DELETE_FUNC_NAME
 
 local function delete_on_storage(space_name, key, field_names, opts)
     dev_checks('string', '?', '?table', {
@@ -52,7 +53,7 @@ local function delete_on_storage(space_name, key, field_names, opts)
 end
 
 function delete.init()
-   _G._crud.delete_on_storage = delete_on_storage
+    utils.init_storage_call(DELETE_FUNC_NAME, delete_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -127,7 +128,7 @@ local function call_delete_on_router(vshard_router, space_name, key, opts)
     }
 
     local storage_result, err = call.single(vshard_router,
-        bucket_id_data.bucket_id, DELETE_FUNC_NAME,
+        bucket_id_data.bucket_id, CRUD_DELETE_FUNC_NAME,
         {space_name, key, opts.fields, delete_on_storage_opts},
         call_opts
     )
diff --git a/crud/get.lua b/crud/get.lua
index 300c2c33..5126a112 100644
--- a/crud/get.lua
+++ b/crud/get.lua
@@ -14,7 +14,8 @@ local GetError = errors.new_class('GetError', {capture_stack = false})
 
 local get = {}
 
-local GET_FUNC_NAME = '_crud.get_on_storage'
+local GET_FUNC_NAME = 'get_on_storage'
+local CRUD_GET_FUNC_NAME = utils.get_storage_call(GET_FUNC_NAME)
 
 local function get_on_storage(space_name, key, field_names, opts)
     dev_checks('string', '?', '?table', {
@@ -50,7 +51,7 @@ local function get_on_storage(space_name, key, field_names, opts)
 end
 
 function get.init()
-   _G._crud.get_on_storage = get_on_storage
+    utils.init_storage_call(GET_FUNC_NAME, get_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -125,7 +126,7 @@ local function call_get_on_router(vshard_router, space_name, key, opts)
     }
 
     local storage_result, err = call.single(vshard_router,
-        bucket_id_data.bucket_id, GET_FUNC_NAME,
+        bucket_id_data.bucket_id, CRUD_GET_FUNC_NAME,
         {space_name, key, opts.fields, get_on_storage_opts},
         call_opts
     )
diff --git a/crud/insert.lua b/crud/insert.lua
index e931bf0f..868768d8 100644
--- a/crud/insert.lua
+++ b/crud/insert.lua
@@ -12,7 +12,8 @@ local InsertError = errors.new_class('InsertError', {capture_stack = false})
 
 local insert = {}
 
-local INSERT_FUNC_NAME = '_crud.insert_on_storage'
+local INSERT_FUNC_NAME = 'insert_on_storage'
+local CRUD_INSERT_FUNC_NAME = utils.get_storage_call(INSERT_FUNC_NAME)
 
 local function insert_on_storage(space_name, tuple, opts)
     dev_checks('string', 'table', {
@@ -53,7 +54,7 @@ local function insert_on_storage(space_name, tuple, opts)
 end
 
 function insert.init()
-   _G._crud.insert_on_storage = insert_on_storage
+    utils.init_storage_call(INSERT_FUNC_NAME, insert_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -102,7 +103,7 @@ local function call_insert_on_router(vshard_router, space_name, original_tuple,
     }
 
     local storage_result, err = call.single(vshard_router,
-        sharding_data.bucket_id, INSERT_FUNC_NAME,
+        sharding_data.bucket_id, CRUD_INSERT_FUNC_NAME,
         {space_name, tuple, insert_on_storage_opts},
         call_opts
     )
diff --git a/crud/insert_many.lua b/crud/insert_many.lua
index d7415297..c0a41099 100644
--- a/crud/insert_many.lua
+++ b/crud/insert_many.lua
@@ -16,7 +16,8 @@ local InsertManyError = errors.new_class('InsertManyError', {capture_stack = fal
 
 local insert_many = {}
 
-local INSERT_MANY_FUNC_NAME = '_crud.insert_many_on_storage'
+local INSERT_MANY_FUNC_NAME = 'insert_many_on_storage'
+local CRUD_INSERT_MANY_FUNC_NAME = utils.get_storage_call(INSERT_MANY_FUNC_NAME)
 
 local function insert_many_on_storage(space_name, tuples, opts)
     dev_checks('string', 'table', {
@@ -123,7 +124,7 @@ local function insert_many_on_storage(space_name, tuples, opts)
 end
 
 function insert_many.init()
-    _G._crud.insert_many_on_storage = insert_many_on_storage
+    utils.init_storage_call(INSERT_MANY_FUNC_NAME, insert_many_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -175,7 +176,7 @@ local function call_insert_many_on_router(vshard_router, space_name, original_tu
 
     local postprocessor = BatchPostprocessor:new(vshard_router)
 
-    local rows, errs, storages_info = call.map(vshard_router, INSERT_MANY_FUNC_NAME, nil, {
+    local rows, errs, storages_info = call.map(vshard_router, CRUD_INSERT_MANY_FUNC_NAME, nil, {
         timeout = opts.timeout,
         mode = 'write',
         iter = iter,
diff --git a/crud/len.lua b/crud/len.lua
index 7387a13b..db487be9 100644
--- a/crud/len.lua
+++ b/crud/len.lua
@@ -8,7 +8,8 @@ local LenError = errors.new_class('LenError', {capture_stack = false})
 
 local len = {}
 
-local LEN_FUNC_NAME = '_crud.len_on_storage'
+local LEN_FUNC_NAME = 'len_on_storage'
+local CRUD_LEN_FUNC_NAME = utils.get_storage_call(LEN_FUNC_NAME)
 
 local function len_on_storage(space_name)
     dev_checks('string|number')
@@ -17,7 +18,7 @@ local function len_on_storage(space_name)
 end
 
 function len.init()
-    _G._crud.len_on_storage = len_on_storage
+    utils.init_storage_call(LEN_FUNC_NAME, len_on_storage)
 end
 
 --- Calculates the number of tuples in the space for memtx engine
@@ -61,7 +62,7 @@ function len.call(space_name, opts)
         return nil, LenError:new("Space %q doesn't exist", space_name)
     end
 
-    local results, err = vshard_router:map_callrw(LEN_FUNC_NAME, {space_name}, opts)
+    local results, err = vshard_router:map_callrw(CRUD_LEN_FUNC_NAME, {space_name}, opts)
 
     if err ~= nil then
         return nil, LenError:new("Failed to call len on storage-side: %s", err)
diff --git a/crud/readview.lua b/crud/readview.lua
index 5a9d7251..cdc0ebdd 100644
--- a/crud/readview.lua
+++ b/crud/readview.lua
@@ -18,6 +18,12 @@ local ReadviewError = errors.new_class('ReadviewError', {capture_stack = false})
 local has_merger = (utils.tarantool_supports_external_merger() and
     package.search('tuple.merger')) or utils.tarantool_has_builtin_merger()
 
+local OPEN_FUNC_NAME = 'readview_open_on_storage'
+local CRUD_OPEN_FUNC_NAME = utils.get_storage_call(OPEN_FUNC_NAME)
+local SELECT_FUNC_NAME = 'select_readview_on_storage'
+local CLOSE_FUNC_NAME = 'readview_close_on_storage'
+local CRUD_CLOSE_FUNC_NAME = utils.get_storage_call(CLOSE_FUNC_NAME)
+
 if (not utils.tarantool_version_at_least(2, 11, 0))
 or (tarantool.package ~= 'Tarantool Enterprise') or (not has_merger) then
     return {
@@ -224,9 +230,9 @@ function Readview_obj:pairs(space_name, user_conditions, opts)
 end
 
 function readview.init()
-    _G._crud.readview_open_on_storage = readview_open_on_storage
-    _G._crud.readview_close_on_storage = readview_close_on_storage
-    _G._crud.select_readview_on_storage = select_readview_on_storage
+    utils.init_storage_call(OPEN_FUNC_NAME, readview_open_on_storage)
+    utils.init_storage_call(CLOSE_FUNC_NAME, readview_close_on_storage)
+    utils.init_stirage_call(SELECT_FUNC_NAME, select_readview_on_storage)
  end
 
 function Readview_obj:close(opts)
@@ -257,7 +263,7 @@ function Readview_obj:close(opts)
         for replica_uuid, replica in pairs(replicaset.replicas) do
             for _, value in pairs(self._uuid) do
                 if replica_uuid == value.uuid then
-                    local replica_result, replica_err = replica.conn:call('_crud.readview_close_on_storage',
+                    local replica_result, replica_err = replica.conn:call(CRUD_CLOSE_FUNC_NAME,
                     {self._uuid}, {timeout = opts.timeout})
                     if replica_err ~= nil then
                         table.insert(errors, ReadviewError:new("Failed to close Readview on storage: %s", replica_err))
@@ -297,7 +303,7 @@ function Readview_obj.create(vshard_router, opts)
     setmetatable(readview, Readview_obj)
 
     readview._name = opts.name
-    local results, err, err_uuid = vshard_router:map_callrw('_crud.readview_open_on_storage',
+    local results, err, err_uuid = vshard_router:map_callrw(CRUD_OPEN_FUNC_NAME,
         {readview._name}, {timeout = opts.timeout})
     if err ~= nil then
         return nil,
diff --git a/crud/replace.lua b/crud/replace.lua
index eb400a96..de83febe 100644
--- a/crud/replace.lua
+++ b/crud/replace.lua
@@ -12,7 +12,8 @@ local ReplaceError = errors.new_class('ReplaceError', { capture_stack = false })
 
 local replace = {}
 
-local REPLACE_FUNC_NAME = '_crud.replace_on_storage'
+local REPLACE_FUNC_NAME = 'replace_on_storage'
+local CRUD_REPLACE_FUNC_NAME = utils.get_storage_call(REPLACE_FUNC_NAME)
 
 local function replace_on_storage(space_name, tuple, opts)
     dev_checks('string', 'table', {
@@ -53,7 +54,7 @@ local function replace_on_storage(space_name, tuple, opts)
 end
 
 function replace.init()
-   _G._crud.replace_on_storage = replace_on_storage
+    utils.init_storage_call(REPLACE_FUNC_NAME, replace_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -101,7 +102,7 @@ local function call_replace_on_router(vshard_router, space_name, original_tuple,
         timeout = opts.timeout,
     }
     local storage_result, err = call.single(vshard_router,
-        sharding_data.bucket_id, REPLACE_FUNC_NAME,
+        sharding_data.bucket_id, CRUD_REPLACE_FUNC_NAME,
         {space_name, tuple, replace_on_storage_opts},
         call_opts
     )
diff --git a/crud/replace_many.lua b/crud/replace_many.lua
index 66385502..db5a4a45 100644
--- a/crud/replace_many.lua
+++ b/crud/replace_many.lua
@@ -16,7 +16,8 @@ local ReplaceManyError = errors.new_class('ReplaceManyError', {capture_stack = f
 
 local replace_many = {}
 
-local REPLACE_MANY_FUNC_NAME = '_crud.replace_many_on_storage'
+local REPLACE_MANY_FUNC_NAME = 'replace_many_on_storage'
+local CRUD_REPLACE_MANY_FUNC_NAME = utils.get_storage_call(REPLACE_MANY_FUNC_NAME)
 
 local function replace_many_on_storage(space_name, tuples, opts)
     dev_checks('string', 'table', {
@@ -126,7 +127,7 @@ local function replace_many_on_storage(space_name, tuples, opts)
 end
 
 function replace_many.init()
-    _G._crud.replace_many_on_storage = replace_many_on_storage
+    utils.init_storage_call(REPLACE_MANY_FUNC_NAME, replace_many_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -178,7 +179,7 @@ local function call_replace_many_on_router(vshard_router, space_name, original_t
 
     local postprocessor = BatchPostprocessor:new(vshard_router)
 
-    local rows, errs, storages_info = call.map(vshard_router, REPLACE_MANY_FUNC_NAME, nil, {
+    local rows, errs, storages_info = call.map(vshard_router, CRUD_REPLACE_MANY_FUNC_NAME, nil, {
         timeout = opts.timeout,
         mode = 'write',
         iter = iter,
diff --git a/crud/select.lua b/crud/select.lua
index 74bffdfa..db6dc4fe 100644
--- a/crud/select.lua
+++ b/crud/select.lua
@@ -12,6 +12,8 @@ local SelectError = errors.new_class('SelectError')
 
 local select_module
 
+local SELECT_FUNC_NAME = 'select_on_storage'
+
 local select_module_compat_info = stash.get(stash.name.select_module_compat_info)
 local has_merger = (utils.tarantool_supports_external_merger() and
     package.search('tuple.merger')) or utils.tarantool_has_builtin_merger()
@@ -124,7 +126,7 @@ local function select_on_storage(space_name, index_id, conditions, opts)
 end
 
 function select_module.init()
-   _G._crud.select_on_storage = select_on_storage
+    utils.init_storage_call(SELECT_FUNC_NAME, select_on_storage)
 end
 
 return select_module
diff --git a/crud/select/compat/common.lua b/crud/select/compat/common.lua
index 6d27b956..6d98e490 100644
--- a/crud/select/compat/common.lua
+++ b/crud/select/compat/common.lua
@@ -1,10 +1,11 @@
 local ratelimit = require('crud.ratelimit')
+local utils = require('crud.common.utils')
 local check_select_safety_rl = ratelimit.new()
 
 local common = {}
 
-common.SELECT_FUNC_NAME = '_crud.select_on_storage'
-common.READVIEW_SELECT_FUNC_NAME ='_crud.select_readview_on_storage'
+common.SELECT_FUNC_NAME = utils.get_storage_call('select_on_storage')
+common.READVIEW_SELECT_FUNC_NAME = utils.get_storage_call('select_readview_on_storage')
 common.DEFAULT_BATCH_SIZE = 100
 
 common.check_select_safety = function(space_name, plan, opts)
diff --git a/crud/truncate.lua b/crud/truncate.lua
index 31cc5842..9dcbb219 100644
--- a/crud/truncate.lua
+++ b/crud/truncate.lua
@@ -9,7 +9,8 @@ local TruncateError = errors.new_class('TruncateError', {capture_stack = false})
 
 local truncate = {}
 
-local TRUNCATE_FUNC_NAME = '_crud.truncate_on_storage'
+local TRUNCATE_FUNC_NAME = 'truncate_on_storage'
+local CRUD_TRUNCATE_FUNC_NAME = utils.get_storage_call(TRUNCATE_FUNC_NAME)
 
 local function truncate_on_storage(space_name)
     dev_checks('string')
@@ -23,7 +24,7 @@ local function truncate_on_storage(space_name)
 end
 
 function truncate.init()
-   _G._crud.truncate_on_storage = truncate_on_storage
+    utils.init_storage_call(TRUNCATE_FUNC_NAME, truncate_on_storage)
 end
 
 --- Truncates specified space
@@ -59,7 +60,7 @@ function truncate.call(space_name, opts)
     end
 
     local replicasets = vshard_router:routeall()
-    local _, err = call.map(vshard_router, TRUNCATE_FUNC_NAME, {space_name}, {
+    local _, err = call.map(vshard_router, CRUD_TRUNCATE_FUNC_NAME, {space_name}, {
         mode = 'write',
         replicasets = replicasets,
         timeout = opts.timeout,
diff --git a/crud/update.lua b/crud/update.lua
index cd31f149..8f9cdc2c 100644
--- a/crud/update.lua
+++ b/crud/update.lua
@@ -14,7 +14,8 @@ local UpdateError = errors.new_class('UpdateError', {capture_stack = false})
 
 local update = {}
 
-local UPDATE_FUNC_NAME = '_crud.update_on_storage'
+local UPDATE_FUNC_NAME = 'update_on_storage'
+local CRUD_UPDATE_FUNC_NAME = utils.get_storage_call(UPDATE_FUNC_NAME)
 
 local function update_on_storage(space_name, key, operations, field_names, opts)
     dev_checks('string', '?', 'table', '?table', {
@@ -74,7 +75,7 @@ local function update_on_storage(space_name, key, operations, field_names, opts)
 end
 
 function update.init()
-   _G._crud.update_on_storage = update_on_storage
+    utils.init_storage_call(UPDATE_FUNC_NAME, update_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -156,7 +157,7 @@ local function call_update_on_router(vshard_router, space_name, key, user_operat
     }
 
     local storage_result, err = call.single(vshard_router,
-        bucket_id_data.bucket_id, UPDATE_FUNC_NAME,
+        bucket_id_data.bucket_id, CRUD_UPDATE_FUNC_NAME,
         {space_name, key, operations, opts.fields, update_on_storage_opts},
         call_opts
     )
diff --git a/crud/upsert.lua b/crud/upsert.lua
index 9300915a..09cd0cab 100644
--- a/crud/upsert.lua
+++ b/crud/upsert.lua
@@ -12,7 +12,8 @@ local UpsertError = errors.new_class('UpsertError', { capture_stack = false})
 
 local upsert = {}
 
-local UPSERT_FUNC_NAME = '_crud.upsert_on_storage'
+local UPSERT_FUNC_NAME = 'upsert_on_storage'
+local CRUD_UPSERT_FUNC_NAME = utils.get_storage_call(UPSERT_FUNC_NAME)
 
 local function upsert_on_storage(space_name, tuple, operations, opts)
     dev_checks('string', 'table', 'table', {
@@ -50,7 +51,7 @@ local function upsert_on_storage(space_name, tuple, operations, opts)
 end
 
 function upsert.init()
-   _G._crud.upsert_on_storage = upsert_on_storage
+    utils.init_storage_call(UPSERT_FUNC_NAME, upsert_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -107,7 +108,7 @@ local function call_upsert_on_router(vshard_router, space_name, original_tuple,
     }
 
     local storage_result, err = call.single(vshard_router,
-        sharding_data.bucket_id, UPSERT_FUNC_NAME,
+        sharding_data.bucket_id, CRUD_UPSERT_FUNC_NAME,
         {space_name, tuple, operations, upsert_on_storage_opts},
         call_opts
     )
diff --git a/crud/upsert_many.lua b/crud/upsert_many.lua
index 236c4135..978d52c7 100644
--- a/crud/upsert_many.lua
+++ b/crud/upsert_many.lua
@@ -16,7 +16,8 @@ local UpsertManyError = errors.new_class('UpsertManyError', {capture_stack = fal
 
 local upsert_many = {}
 
-local UPSERT_MANY_FUNC_NAME = '_crud.upsert_many_on_storage'
+local UPSERT_MANY_FUNC_NAME = 'upsert_many_on_storage'
+local CRUD_UPSERT_MANY_FUNC_NAME = utils.get_storage_call(UPSERT_MANY_FUNC_NAME)
 
 local function upsert_many_on_storage(space_name, tuples, operations, opts)
     dev_checks('string', 'table', 'table', {
@@ -120,7 +121,7 @@ local function upsert_many_on_storage(space_name, tuples, operations, opts)
 end
 
 function upsert_many.init()
-    _G._crud.upsert_many_on_storage = upsert_many_on_storage
+    utils.init_storage_call(UPSERT_MANY_FUNC_NAME, upsert_many_on_storage)
 end
 
 -- returns result, err, need_reload
@@ -189,7 +190,7 @@ local function call_upsert_many_on_router(vshard_router, space_name, original_tu
 
     local postprocessor = BatchPostprocessor:new(vshard_router)
 
-    local _, errs, storages_info = call.map(vshard_router, UPSERT_MANY_FUNC_NAME, nil, {
+    local _, errs, storages_info = call.map(vshard_router, CRUD_UPSERT_MANY_FUNC_NAME, nil, {
         timeout = opts.timeout,
         mode = 'write',
         iter = iter,
diff --git a/doc/playground.lua b/doc/playground.lua
index 2453c063..d4e547f0 100755
--- a/doc/playground.lua
+++ b/doc/playground.lua
@@ -43,9 +43,6 @@ end
 
 -- Setup vshard.
 _G.vshard = vshard
-box.once('guest', function()
-    box.schema.user.grant('guest', 'super')
-end)
 local uri = 'guest@localhost:3301'
 local cfg = {
     bucket_count = 3000,
diff --git a/test/entrypoint/srv_say_hi/all_init.lua b/test/entrypoint/srv_say_hi/all_init.lua
index dee0c40d..39b88bfd 100644
--- a/test/entrypoint/srv_say_hi/all_init.lua
+++ b/test/entrypoint/srv_say_hi/all_init.lua
@@ -1,11 +1,20 @@
 local fiber = require('fiber')
 
+-- Adds execution rights to a function for a vshard storage user.
+local function add_storage_execute(func_name)
+    if box.cfg.read_only == false and box.schema.user.exists('storage') then
+        box.schema.func.create(func_name, {setuid = true})
+        box.schema.user.grant('storage', 'execute', 'function', func_name)
+    end
+end
+
 return function()
     rawset(_G, 'say_hi_politely', function (to_name)
        to_name = to_name or "handsome"
        local my_alias = box.info.id
        return string.format("HI, %s! I am %s", to_name, my_alias)
     end)
+    add_storage_execute('say_hi_politely')
 
     rawset(_G, 'say_hi_sleepily', function (time_to_sleep)
        if time_to_sleep ~= nil then
@@ -14,12 +23,14 @@ return function()
 
        return "HI"
     end)
+    add_storage_execute('say_hi_sleepily')
 
     rawset(_G, 'vshard_calls', {})
 
     rawset(_G, 'clear_vshard_calls', function()
         table.clear(_G.vshard_calls)
     end)
+    add_storage_execute('clear_vshard_calls')
 
     rawset(_G, 'patch_vshard_calls', function(vshard_call_names)
         local vshard = require('vshard')
@@ -42,4 +53,7 @@ return function()
             end
         end
     end)
+    add_storage_execute('patch_vshard_calls')
+
+    add_storage_execute('non_existent_func')
 end
diff --git a/test/vshard_helpers/vtest.lua b/test/vshard_helpers/vtest.lua
index dc717c77..b0662010 100644
--- a/test/vshard_helpers/vtest.lua
+++ b/test/vshard_helpers/vtest.lua
@@ -393,7 +393,7 @@ local function cluster_new(g, cfg)
 
             cfg.engine = nil
             require('vshard.storage').cfg(cfg, box.info.uuid)
-            box.schema.user.grant('storage', 'super')
+            box.schema.user.grant('storage', 'write,read', 'universe')
 
             box.session.su(user)
         end, {cfg})