AJAX API permissions
I believe there is currently a bug. I have submitted a bug report:

https://issues.civicrm.org/jira/browse/CRM-20582

When I ran into my issue, I was told:

"If you need a quick fix that doesn't involve granting more permissions than users ought to have, take a look at https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_alterAPIPermissions/."