Your question implies that in your instance an admin can display principal classes. To do that you first must have the supporting data, or else nothing will be displayed to anyone, so let's start there just to make sure. In the left nav type cmdb_class_info.list to display all of the CMDB Class Information records. There is a column on this table named principal_class that needs to be checked on a record for that Class to be considered a Principal Class, so CIs in that class will show up in the Principal Class filter. Once you're sure you have at least one record with a CI class that's used in your instance which has the Principal Class box checked, run the filter on the CI table as an admin and confirm that you can see the expected CIs. Once you've made it this far (sorry for starting from the beginning if you already were this far when you asked the question), there really shouldn't be an ACL or anything in place to prevent a non-admin from seeing the same results.
The filter calls a script include named PrincipalClass, and the function inside of there named getPrincipalClasses, which really just calls another function named getClasses with a flag to be used in the query. All that is to say the filter is really just calling a script that runs a query on the cmdb_class_info table to return all of the records where the principal_class field is checked/true, then pushes the class names into an array. In short the filter is really just saying "show me all of the CI records who have a class that is one of the principal classes". So if you have cmdb_ci_computer and cmdb_ci_server flagged as principal classes, the filter will show you all of the computers and servers. If a user can view the records in a list view without the filter, or in the example above manually applying a filter that says Class is Computer or Class is Server, then applying this filter can't shouldn't prevent them from seeing the same results.
