API access not locked

Hey there,
I noticed that users with restricted access can still access objects through the API that they wouldn't be able to access through the Daylite desktop app. During testing I didn't find any endpoint that works as expected. How are clients supposed to handle that?

Take care,

Pascal