When the content of a Datastream object is requested (which is an API-A request), there is first a call to populateDatastreamInfo(), which attempts to retrieve the full history of a datastream. This request, however, uses API-M.
The problem emerges when an object may have a POLICY datastream that permits API-A but which denies API-M (i.e. other than to administrators). Then, when a non-administrator tries to simply view the object, the request is denied.