Would be better for me here if AccessPolicy actually gave me access to the ApiUser object in this method, instead of passing the human_user.