If you want to access plugins, you can work with anonymous users. Therefore the PluginAPI works with AnonymousAppProfile.

So only the assigned role to your Application needs the permission to use the Plugin.

Read more about roles.