Right now the UI is kind of lying about the permissions if a suspended user is there, whether they were added after being suspended or became suspended after the fact.

Reasoning being:

1. You can add a suspended user, but then it will just not show up which is confusing (and even more sketchy, it does not record in the audit log).
2. It could cause someone to think a user has no permissions, then if they unsuspend the user "suddenly" they have permissions again.
3. Someone might know a suspended user had permissions, but when they go to check they cannot see the user and cannot remove the permissions.

But, I am not completely sure about the workflow/use case around suspension so these concerns might be invalid or at least inaccurate.

So, I think we should included suspended users in that query. Alternatively we could prevent adding suspended users in the first place, and remove all their permissions when they become suspended. More work, but depending on what suspension is meant to be maybe it makes more sense to do it that way. Is it a more final action somewhat like deletion, or is it something that should be easily reverted without having to go around adding permissions all over again?