If it does have to be real time (client script) then you need to create a suitelet that does the work for you, and call the suitelet, have the suitelet do the stuff that customers don't have permissions to do, then feed the result back to your client script to react to it.