Capabilities, permissions and contexts for webservices user

I'm creating various API based scripts to do some moodle housekeeping. 

I have created a role and added every capability listed for the endpoints that I have enabled, and have given the housekeeping user that role at the system context.

But I constantly get access permissions errors unless I make that usere a site admin (which obviously I don't want to do long term).

How do I make sure my housekeeping user has the housekeeping role, with the correct capabilities, when the relevant API call is looking in a course context? Is it not enough to give them that role at system level? 

I do want my API housekeeping user to have access to all courses across all categories so that I can manipulate e.g course enrolments. But surely that's precisely what assigning the role at system level is supposed to do?

Best wishes,

Jock Coats