Issue #21190 Take advantage of the personal privs feature to restrict API access by API user

Don't merge this with production yet. It needs to be ran through testing and checked to see if this approach works without causing other issues.