I am exploring Airflow RBAC capabilities (https://airflow.apache.org/docs/stable/security.html?highlight=ldap#rbac-ui-security) and am disappointed to discover that they only apply to the Airflow UI, as far as I can tell it is not possible to determine what a user can do via either the experimental API or the Airflow CLI. For example, I can restrict someone from triggering DAGs via the UI but they could still do it using the Experimental API or CLI.
I've just come here to verify that this is indeed the case and ask whether there is any other mechanism to govern usage of the experimental API or CLI? I flly suspect the answer to be "there is no mechanism to govern usage of the experimental API or CLI" but no harm in asking.