I should be able to edit Things that I create
Summary: The current security model has a hole: if I have Create privs, but not Edit, then I create a Thing and immediately can't do anything with it!
This is currently only High priority because we don't yet have a use case that calls for this security approach. But it'll matter for any sort of Space that allows some members to contribute, but not edit the "completed" Things -- I expect it to be moderately common.
The fix depends on reifying a notion of the "owner" of a Thing. When I create a Thing, I immediately "own" it, and the owner of a Thing can always edit it.
Along with this, there should be a "Claim" or "Promote" button, which changes the owner of the Thing to the Owner of the Space, or the Editor who claims it, or something like that. At that point, the original creator no longer has control of this Thing.
Note that this notion of "owner" is separate from that of "creator", which we should also be tracking. The creator should be some sort of pseudo-Property is that is automatically set when we are resolving a Create event, based on who actually created it, and should not be externally settable. "Owner" should default to "creator", but can be overridden.