This class of service is endowed with properties that enable it to be constrained by fine-grained access controls (ACLs) that cover identity-scoped privileges such as: read, sponger middleware service controlled write, and general write. By default all identity principals (users) are granted read access and sponger controlled write .