How sophisticated does my authorization system have to be? Do I need to have ACLs to control who is allowed to read and write data?
You need to make sure that only the original publisher of a document is allowed to change or replace that document. You don’t need any other form of authorization. Note that consumers must be able to authenticate the contents of documents they retrieve, to make sure the data they get are the data the publisher published. This is a distinct idea from authorization, though you may find it convenient to have overlap between the mechanisms for the two.
