I think that lies under the authorization domain.

Maybe we could start with a couple of dummy _authorization providers_ like:
  - **User role**. So we can trigger a 401 when the user could not be authenticated and therefore the provided user does not have a `authenticated user` role.
  - **User permission**. So we can limit the requests to certain user roles. I'm thinking about maybe defining permissions per endpoint & version, or just leaving it up to existing permissions.