Ref T4345. This error is per object-type in the query implementations, not a mail/permissions issue.
Without didRejectResult(), we can't distinguish between "restricted" and "unknown" for objects filtered by willFilterPage().
- Call didRejectResult() on commits.
- Make didRejectResult() handle both existing policy exceptions and filtering.
- Recover from partial objects (like commits) which are missing attached data required to figure out policies.