Use APIUser for permission checks