Redfish Schema and actions

For Q1, this is a bit ambiguous since the permissions term doesn't appear to have a default value. When we publish schema definitions, we explicitly call out their permissions to ensure the intent is clear. One thing to be cautious of though is we omit the permissions term on objects containing sets of properties and put the permissions on the properties within an object. The reason for this is within an object, you can have a mix of read-only and writable properties, so an object-level permission definition doesn't make that apparent.

For Q2, POST has two usages: creating a new resource and performing an action. POST from a create perspective does not require additional schema definitions since the client is creating a new instance of a resource that is backed by schema. For example, if you're creating a new EventDestination resource, the client builds the new EventDestination resource (based off the EventDestination schema) and performs a POST on the EventDestinationCollection resource. Actions require their own schema definitions since the client is not inserting a new resource, but rather performing an operation that does not map to CRUD semantics. The request and response payloads in these cases don't match resource definitions.