Right now these are fetched with the persistence service https://github.com/cap-java/cds-ai/blob/main/cds-feature-recommendations/src/main/java/com/sap/cds/feature/recommendation/FioriRecommendationHandler.java#L123.
This bypasses the application service and authorization restrictions. As a result, a user could receive recommendations trained on rows they are not allowed to read.
Right now these are fetched with the persistence service https://github.com/cap-java/cds-ai/blob/main/cds-feature-recommendations/src/main/java/com/sap/cds/feature/recommendation/FioriRecommendationHandler.java#L123.
This bypasses the application service and authorization restrictions. As a result, a user could receive recommendations trained on rows they are not allowed to read.