somewhat linked to T4358

Use case:
The view policy for the People list page is: Admins only.
Project A and B are both for different clients, both should be unaware of the other.
Project A: John Smith, Joanne Smith
Project B: John Hitms
These are all normal users, no one is the janitor (Admin)

John Smith goes to the People list page, he sees an error explaining he doesnt have a right to see all the people. This works as expected.

Joanne Smith adds a Maniphest task and starts writing "John".
Expected result: The autocomplete list only shows John Smith.
Actual result: The autocomplete list shows both John Smith and John Hitms