In the current version, Leads::view() never calls the framework's access-check at all — the hasAccess() call is commented out in the controller (// $this->hasAccess();), and the corresponding have_permission("leads") check on the menu entry is also commented out. That means opening /admin/leads does not require being logged in as staff, let alone any specific permission — the page (including every captured email address) is reachable by anyone who has the URL, logged in or not. This looks like an oversight rather than an intentional design; if lead data should be protected, flag it to Sprwt support/engineering.