This spec ensures the access policy won't allow ApiUsers with a human_user.