When the caller isn't the organizer, use Events: update with proper authorization and exclude the resource from the attendees list.