Permissions on user information?

I applied a mod to the ShowPeople Element on a ticket that uses
<%$UserObj->WorkPhone%> to display the requestor’s phone number.

Only people with full admin access to the RT system can see the phone
number. I looked through the permissions and did not see anything
obvious that allows us to control who can see directory information like
that.

Any suggestions? I obviously don’t want normal users to have full write
access to change people’s directory info.