At first I was thinking "It takes the kind of money only Microsoft has to create some of the best ads in the world"... Then I hit me "It takes the kind of money only Microsoft has to make the poor actors participate in Microsoft ads." It's gotta be a payment big enough for a lifetime of no acting contracts.

When I read the title I was very eager to comment on wrongfulness of this research, as I'm convinced that valuable objects stimulate my junk more than my brain. I mean, cheap stuff works too, but doesn't inspire much I guess.

True. Although hopefully you never build an ACL in your open editable javascript code. You should certainly not permit anything meaningful to happen without asking server if that's allowed. Then the only problem remains is for all that mess that the client created to be valid. Maybe I'm misunderstanding something?.. This whole conversation is pretty hand-wavy.

For that you constrain your database with foreign key constraints, and if you're using Postgres and ActiveRecord and Migrations - check out this gem. This way you're guaranteed that whatever enters your database is always valid. Unless you screwed up something of course. : )