Which users a user can write Persistence data to is a policy decision that
is made by each OpenSocial container. Currently, the "default" policy that
most active containers have implemented is that an application can only write to
VIEWER data, and only if the VIEWER has the application installed.
This policy is fairly restrictive to prevent
malicious users from writing data to arbitrary users, so it
is expected to be the most commonly implemented Persistence data policy.
This article was written under the assumption that data will only be
writeable to VIEWERs with the application installed, and presents
advice on how to structure applications around this limitation.
It is certainly possible that some containers may implement
a more relaxed data policy that allows users to write data to other users'
Persistence data. Additionally, some containers may choose to give their
users the ability to set ACLs on their Persistence data. In this model,
a user would be able to whitelist other user accounts to read from or write
to their own Persistence data.




