This object has special rules which override normal object policy rules:
Can View: randomuser ("><img src=x><")
In detail, this means that these users can take this action, provided they pass all of the checks described above first: