docs: protected IPersonAttributes getVisiblePerson(
              final IAuthorizationPrincipal principal,
              final IPersonAttributes person,
              final Set<String> generallyPermittedAttributes) {
  
          // first check to see if the principal has permission to view this person.  Unfortunately
          // for
          // non-admin users, this will result in a call to PersonDirectory (which may go out to LDAP
          // or
          // other external systems) to find out what groups the person is in to see if the principal
          // has permission or deny through one of the contained groups.
          if (person.getName() != null
                  && principal.hasPermission(
                          IPermission.PORTAL_USERS,
                          IPermission.VIEW_USER_ACTIVITY,
                          person.getName())) {
  
              // If the user has permission, filter the person attributes according
              // to the specified permitted attributes;  the collection of permitted
              // attributes can be different based on whether the user is trying to
              // access information about him/herself.
              final Set<String> permittedAttributes =
                      person.getName().equals(principal.getKey())
                              ? getPermittedOwnAttributes(principal, generallyPermittedAttributes)
                              : generallyPermittedAttributes;
              final Map<String, List<Object>> visibleAttributes = new HashMap<>();
              for (String attr : person.getAttributes().keySet()) {
                  if (permittedAttributes.contains(attr)) {
                      visibleAttributes.put(attr, person.getAttributeValues(attr));
                  }
              }
  
              // use the filtered attribute list to create and return a new
              // person object
              final IPersonAttributes visiblePerson =
                      new NamedPersonImpl(person.getName(), visibleAttributes);
              return visiblePerson;
  
          } else {
              logger.debug(
                      "Principal "
                              + principal.getKey()
                              + " does not have permissions to view user "
                              + person.getName());
              return null;
          }
      }