For our HIPAA-compliant application, users should not be able to discover other users, except by using their randomly generated sharing key, a behavior we plan to implement in Business Logic.



How do we disable all other forms of user discovery, like first/last name lookup? Should we manually write Business Logic for "before User fetch", or is there a setting we can change?

We are planning to add a setting which disables user discovery. After releasing it, user discovery will be disabled by default for new apps, and can be turned off for existing ones.