Hi Ben,

First, we don't give guests access to the full list of users. They may see individual users in other fields, but we don't make, say, core.Users or core.SiteUsers, available to anonymous users.

Users who are actually logged in can typically see user lists, and group memberships (via the query browser and APIs, if no where else). However, for non-admins, do not expose information about other users' permissions. See SecurityApiActions.GetUserPermsAction.execute() as an example.

Your scenario, where you're interested in exposing minimal permission information, seems reasonable. However, it is a slippery slope.

Thanks,
Josh