L36 only requires you to be a member of User-JeanFred to edit, which is a publicly join-able project. Having abilities to edit Legalpad documents allows you to see signatures, which could contain real names and emails and which could potentially be considered PII. It also allows you to enable "Signature Required to use Phabricator" which will kick everyone off Phabricator until they sign it. The project should be removed from the access policy.