Starting a process requires CREATE_INSTANCE permission on the respective process definition. The list of startable processes in tasklist should respect this authorization, such that a user cannot see a process that they cannot start anyway.

Current behavior: The query only filters by READ on process definition.