The user permissions on the Task DocType and Project DocType both require User Permissions of allowed Customer. The user has the permission set.
The left shows the correct reported 2 test tasks. However, if you go to Tasks Tree view, it shows all tasks and you can click to edit them from there… as you can see on the right.
Task ID TASK00006 should not be accessible to the user as the report shows on the left.
I have Strict Permissions set in the global settings… so empty “Customer” tasks should not appear either (correctly excluded in the left-side report).
UPDATE: Adding a Customer value to the Task results in the correct “Permission Denied” message. So this seems to only be a bug with the “Strict Permissions” setting?