everything appears to be showing up in the type ahead list for associating, when it should be only showing those things that you have the rights to see.

This requirement (2.3.3) hasn't been worked on. It has been deferred until the migration to 7 because it requires the latest version of the XACML module.