>  should we (assuming we have authentication working) automatically look up the User associated with the access token and use it as the "owner" of the programmer?

Yes.

> I feel like I'm wanting to make the API a bit more stateful, which I don't intend - I'm slipping in that direction based on how I imagine the API working. Later, if I wanted to see my programmers, the stateful way would be to go to (for example) "/me/programmers". The correct way would be to do something more like "/users/5/programmers".

Even with `/me/...` it will still be stateless as you will always need a valid access token to retrieve the related user/owner.

After having read your reply, I now understand this paragraph, and it makes perfectly sense! Maybe it should be rephrased. I think I misunderstood the term "anonymous" here.