When using a search definition based on a query, if there is no where clause for the tenant, the results can display value from other tenant.
eg: Business Partner Search :
SELECT b.C_BPartner_ID FROM C_BPartner b
INNER JOIN AD_User u ON (b.C_BPartner_ID = u.C_BPartner_ID)
WHERE UPPER(b.name) LIKE UPPER( ? ) OR UPPER(u.name) LIKE UPPER( ? )
Perhaps we should do role.addAccessSQL on the sql statement ?