Typeahead boxes usually hit a cheap prefix query on titles so the dropdown feels instant. That path often filters by workspace_id and maybe soft-delete, then returns the matching strings. The full list page runs the viewer ACL. Autocomplete does not.
A guest types "payroll" and the dropdown shows "Q3 payroll lock / HR vault". The list page for that guest is empty. The title already leaked in the suggestion.
Point autocomplete at the same filtered query the list uses, or run the detail-page read check on each candidate before you render the label. If a candidate fails, drop it. Don't show a greyed-out row that still prints the name.
Quick test: as a limited viewer, confirm a private record is missing from the list, then focus the search box and type part of its title. If the suggestion appears, autocomplete skipped the check.
Top comments (0)