I see that the user access policy doesn't allow non-application users to get results from this endpoint, but that code doesn't have explicit statements for this method.  Can you check that we have a spec that proves that non-application users can't query this endpoint?  Just so we prevent ourselves from changing the access policy in the future in a bad way.