If I do not use labels and instead string all their projects together into the board's filter, then permissions work correctly. This behavior changed recently in our cloud based instance (Feb 2016) and is for some reason also affecting our internally hosted JIRA (v6.2#6252-sha1:aa34325).