I've been exploring ProcessWire for the past week and really like the simplicity, power, and flexibility.  The site that I plan to build will have a member login, and also a member directory.  I want members to be able to view the profiles of other members, but guest should not be allowed to view the member profiles.  I have a 'member' role defined and have added additional fields to the user template. 
I was experimenting with the access control for the user "pages", but wasn't getting the behavior I expected.  I modified the user template to allow page view for the member role, expecting all selectors to filter appropriately.  When I use selectors with a path for the users like this: 
  $pages->find("parent=/processwire/access/users,  limit=50") 
I get inconsistent results. The guest user usually ends up getting a non-empty page array, meaning it found users, even though the guest user doesn't have the member role, so should never get any users in the results. The results were fickle - some selectors worked as I expected, others didn't. 
I did a similar experiment with regular pages, not the user "pages", and the results were what I expected. The results of the selector are filtered appropriately based on the role of the user executing the selector - only users with the member role got any user results.  
The selector below worked consistently - guest never found any user pages since it doesn't have the member role. 
  $pages->find("template=user")  
and I can add roles=member to remove the admin and guest users from the results.  
This is mostly a theoretical question on what's the right way to search for members, since I am also adding the member role restriction to any page that would browse or access user pages, so no non-member would ever run these selectors. But what is the "right" way to get the list of members with access control applied? 
Thanks, 
  --Sharon