CiviVisualize and permissions
I've taken a look in the code, and it looks like CiviVisualise/Civisualise/Civivisualise the missing CiviCRM visualisation extension (:P :P :P) uses direct SQL commands, meaning that certain CRM features such as ACL checks would be bypassed.

This would need changing at a code level, I'm sure Xavier would love to hear from you.

JohnFF