I'm developing a plugin in which a user can upload, view and delete some private files. Obviously, a user should always only be able to work with his own files, not those of other users.
I'm wondering if it is unwise to do any of these actions with ajax for security reasons. Mainly because https://codex.wordpress.org/AJAX_in_Plugins#Ajax_on_the_Viewer-Facing_Side states that everything executed through admin-ajax.php is executed 'with elevated rights' (under 'Note 2'). Can I still achieve secure differentiation between users and only allow access to the respective AJAX functions for the owner of the file (certainly identify user and his ID for DB selection of files) and for the admin (certainly ensure user has admin rights and grant access to all files)?
Also, how can Nonces increase security in this case? As far as I understand they are only useful if you want to restrict executing an action to a limited number or time, yet their use is highly encouraged in any article about wordpress and ajax regardless of use.