@mksd thanks for sharing! We will be moving datafilter functionality to core 3.0.x… we may try to do it for 2.9.x as well. It is to enable other modules to easily contribute filters for core as well as its own services and other modules without having to declare datafilter dependency. It will be a great addition to the improved authorization framework. Code in core and modules should be always written with a proper access control in mind.
Let me link a related discussion about datafilter module here.