I have worked on projects that occupy this space. I tend to think that it's ok for the client to have arbitrary read access, but for writes it's a better idea for the client to generate events that are then approved and applied by the/a server. The reason for this is that it's much easier to approve high level events than low-level change-sets.