Ok, thank you for the feedback.

Thanks for the response. Thank you for questioning this: Is the "picker" api the only API that can be used by AIO on that point? As there are other "user" API's like "find user that are assignable to issues" which probably is also the one used in the standard JIRA issues... There the global permission isn't required and the permission is covered by project settings.