On a request such as:
A regression was found that has been occurring since October. We realize we must not have functional test coverage for this case:
If there is a privilege filter that should limit members objects, the total objects should be limited by filter. For example, a privilege of "/userName eq 'scarter'" on "managed/user" should limit the results for scarter's roles' members to only those objects with a userName equal to scarter.
Related Jira that is filed for the bug which describes the problem in a bit more detail: