api v8 - acl/filter?

I’m experimenting with v8 (client credentials). getting an access token works fine, and I’ve associated an user with limited rights to this client.

first question:
even though I saw this fixed issue in the changelogs:
#5421 Feature - api acl access (https://github.com/salesagility/SuiteCRM/pull/5421) (7.10.2)

this request (using the limited user described as above) still returns a complete list of all accounts:

if I log in with that user, only 1 account is visible (which is what I expect as well using the api).

is this issue resolved/fixed/wip?

second question: i saw this fix as well:

but filtering still doesnt work for me. Can anyone provide an example how to filter on custom fields?

thanks in advance,

Edit: test system is currently 7.10.14, will test it as well in 7.10.20 now.

v7.10.20 seems to respect the security groups - filter issue stays the same.