I have a use case where 'volunteers' deal with casework on an area basis, with a 'supervisor' for each area. Volunteers can add contacts, and view their own cases. Supervisors can view all cases.
Both roles' access to their area's contacts is limited by Civi's own ACL through each service user being assigned to an area group.
This works up to a point, in that neither group has permission to view cases outside their area, but supervisors' dashboards and dashlets show all cases, regardless of whether those contacts are visible.
Is this expected behaviour, or have I went wrong somewhere?
CiviCase: access all cases and activities View and edit all cases (for visible contacts)