To refine your view so that users can only access there own flagged content, perform these steps using the Views UI:
- Add the relationship "Flags: Node flag", which is used to "Limit results to only those entities flagged by a certain flag; Or display information about the flag set on a entity.".
- Next you need to "Configure" this relationship like so:
- For "Flag" select the actual flag that you want this view to be about (e.g: select the "Bookmark" flag).
- Make sure to set "By" = Current user.
- If you completed the previous steps correctly, in the Views UI you should now have an extra relationship added with something like "Flags: bookmarks (by current user)".
With this, "user will only be able to access their own flagged content", since these are the only possible views results that will be shown. Note however that with only these refinements, you will not get an access denied (only an empty views result).
Notes:
This will return the same results for the admin user (= only the results flagged by the admin user). If the admin user should be able to see flagged content of any user, I suggest you clone this view in another one, in which you omit this "Flags: Node flag" relationship (or simply keep the view you already have, and limit its access to admin users only).
With the above approach, the '%' in your URL has become obsolete.