hrefna, 
The recent incidents have hilighted to me one of my personal struggles with #ActivityPub
My first questions when developing a writeable API are 1. who can call this endpoint 2. what does the payload accepted by this endpoint look like?
AP is largely silent on (1) and is, for lack of a better term, actively hostile to (2).
Then I look at it from a database side and I try to draw a line between the use case and the schema and connect that to the payload.
Which again, AP is hostile toward
1/