Setup permissions for Phases.
Enforce Phase permissions in the PhasesController.
User facing object shouldn't have strict validations.
Add creator and modifier associations to Phase.
Add interface for managing phases.
Extract the auditing so that it gets wrapped in a transaction.