Since the service can create/update grade items and update grades it should be restricted by moodle/grade:manage and moodle/grade:edit respectively. This can be done in the service definition (in db/services.php) to the effect that the API user can either do both or none. Both capabilities are granted by default to the Manager and Teacher roles.