We allow access to a product as long as one stockrecord's partner has
the user in it's list. That more permissive default was chosen as it
reduces UI complexity and we don't want to complicate already complex
behaviour further.