See PHI1697. If a diff is not attached to a revision (for example, if it was created with "arc diff --only"), but is attached to a repository, it is supposed to be visible only to users who can see that repository.

It currently skips this extended policy check and may incorrectly be visible to too many users.

(Once a diff is attached to a revision, this rule is enforced properly via the revision policy.)

• Set repository R to be visible only to Alice.
• As Alice, created a diff from a working copy of repository R with "arc diff --only".
• As Bailey, viewed the diff.
  • Before: visible diff.
  • After: policy exception (as expected).