Authorisation descision filtered vs. read-only

When I look at datasources for example, I can see a difference between :read-resource-description(access-control=true) and the output of :read-resource()

.

The first doesn't contain constraints for "security-domain", but the later indicates them as being filtered (access-control response header).

First question: Is this a bug?

Second and more general question: Will all filtered attributes be presented as "read=false" & "write=false"?