this is solitude, at the moment we don't do any permissions, if you are authenticated you can do anything. For zamboni, I'd start with a very restrictive set of permissions.