At the moment any user/node metadata path security policy constraints are enforced after a DB query has executed, so for list-style results returned rows might be dropped from the results returned to the caller. This impacts pagination. It would be better if the SQL query itself could enforce the policy, so pagination could be fully supported.