Our hudson is configured so that anonymous has no access (view, triggers build, nothing). Yet, without logging in, you can go to Query and Trigger Gerrit Patches, type in a query, and trigger builds. The UI says no jobs were triggered, but after logging back in, the job was indeed triggered. The Query and Trigger Gerrit Patches should at the minimum check that the logged in user has the Build permission for that specific job.