ZenStack Cascading Access Control Security Bug

Problem

ZenStack access control policies using check(relation, 'read') can create cascading permission chains that grant unintended access to private data. Users who can read a public profile may gain access to ALL related private data (availability, bookings, etc.) through chained policies.

Context / Trigger Conditions

Symptoms:

• Users can see other users' private data when they shouldn't
• Access control works correctly for User/Profile models but fails for related data
• Testing with multiple users reveals data leakage
• Calendar or dashboard shows overlapping data from multiple users