diff --git a/src/applications/maniphest/controller/ManiphestTaskDetailController.php b/src/applications/maniphest/controller/ManiphestTaskDetailController.php
--- a/src/applications/maniphest/controller/ManiphestTaskDetailController.php
+++ b/src/applications/maniphest/controller/ManiphestTaskDetailController.php
@@ -198,7 +198,6 @@
     $task_submenu[] = id(new PhabricatorActionView())
       ->setName(pht('Edit Blocking Tasks'))
       ->setHref("/search/attach/{$phid}/TASK/blocks/")
-      ->setWorkflow(true)
       ->setIcon('fa-link')
       ->setDisabled(!$can_edit)
       ->setWorkflow(true);
@@ -206,7 +205,6 @@
     $task_submenu[] = id(new PhabricatorActionView())
       ->setName(pht('Merge Duplicates In'))
       ->setHref("/search/attach/{$phid}/TASK/merge/")
-      ->setWorkflow(true)
       ->setIcon('fa-compress')
       ->setDisabled(!$can_edit)
       ->setWorkflow(true);
diff --git a/src/applications/pholio/event/PholioActionMenuEventListener.php b/src/applications/pholio/event/PholioActionMenuEventListener.php
--- a/src/applications/pholio/event/PholioActionMenuEventListener.php
+++ b/src/applications/pholio/event/PholioActionMenuEventListener.php
@@ -42,7 +42,6 @@
     return  id(new PhabricatorActionView())
       ->setName(pht('Edit Pholio Mocks'))
       ->setHref("/search/attach/{$phid}/MOCK/edge/")
-      ->setWorkflow(true)
       ->setIcon('fa-camera-retro')
       ->setDisabled(!$can_edit)
       ->setWorkflow(true);
diff --git a/src/applications/search/controller/PhabricatorSearchAttachController.php b/src/applications/search/controller/PhabricatorSearchAttachController.php
--- a/src/applications/search/controller/PhabricatorSearchAttachController.php
+++ b/src/applications/search/controller/PhabricatorSearchAttachController.php
@@ -18,6 +18,11 @@
 
     $object = id(new PhabricatorObjectQuery())
       ->setViewer($user)
+      ->requireCapabilities(
+        array(
+          PhabricatorPolicyCapability::CAN_VIEW,
+          PhabricatorPolicyCapability::CAN_EDIT,
+        ))
       ->withPHIDs(array($phid))
       ->executeOne();