Invited users currently have access if invited to all or none of the policies. This is over sharing and a security problem for MSPs where the client wishes to have access and modify their own companies policy. This needs to be restricted.