I am using assignment based permissions. I.E. a user only has access to entities they are assigned to.
When creating a list we are sorting by the state. However, the state is not sorted based on the order of the state. It is sorted by a custom field on the state.
When a user has access to the database as a whole, the sort works fine, however the when the user does not have access to the database the sort is not enforced.