There are currently solid tests for this module. A few test cases are still missing, which should be implemented:
Nodes referencing Users
Taxonomies referencing User
User referencing User
(User referencing Nodes)
(User referencing Taxonomies)
For media let's test that private downloads are blocked if no access is given. That's more a core check, but we use this in our media documents and should be safe this doesn't break!