At the moment you can avoid data access to a user via folder restriction. You can set folder permissions to a single user in order to limit the objects that user can access to. This limitation does not work with most of the APIs. For example even if a user has folder limitations so that he can view only folder A, he can still select data via SelecetRecipiendData API from a database inside folder B.