I think we just discussed this on my blog. As I said there, the Web Services operate under the current user's permissions. I someone doesn't have permissions to do something through the UI, they can't do it through the Web Services. Period.
M.
M.