Additional info I will add here. If you search for just the access profile id (or access profile name) against the “identities” index, this will not work.
You will get all the people with this access profile assigned, PLUS the owner of the access profile, regardless of whether they are assigned the access profile or not.
You must use the @access(id:<AP ID>) if you do not want to include the owner (which I assume is what you’re after).