The assumption is indeed that the state of the data would be the same regardless, but there's no guarantee that's actually the case. I think it's safer to have real users do these actions (which should just be a different REST context). We're trying to protect against a scenario where an admin-created thing would ever behave differently compared to a user-created thing. I'm pretty confident that we're fine now, but I'd like to protect against that being introduced. When Nakamura got started, there were various bugs caused by only testing admins creating stuff.