as the permission on the update operation for User type, but am still able to update an unrelated user

@drk can you please PM me the project id of your project?