Braid-HTTP synchronization proposal: Authentication

[Santiago Bazerque <[e-mail]>]

Hello HTTP group!

I'm interested in using the Braid proposal for adding synchronization
capabilities to HTTP. I would like to use it as a standard interface for
otherwise ad-hoc work in adding decentralization capabilities to web
browsers.

Studying the proposed spec, I'd assume that the intended use of the
extensions is in contexts where HTTP is used as an API language (similar to
say, a REST API), rather as a presentation artifact. This is consistent
with the examples given in the spec about a chat application, where the
changes operate on a JSON representation of the conversation:

         PUT /chat
         Version: "g09ur8z74r"
         Parents: "ej4lhb9z78"
         Content-Type: application/json
         Merge-Type: sync9
         Patches: 2

         Content-Length: 62
         Content-Range: json .messages[1:1]

         [{text: "Yo!",
           author: {type: "link", value: "/user/yobot"}]

How would authentication work in such a setting? Does the proposed
extension formalize some set of rules about who would be allowed to PUT
such a modification, or would that be up to each implementation?

Thanks in advance for any clarifications.

Best,
Santiago Bazerque