Given a person's user name, provide credentials in such a form that they can be compared to visibility constraints.

Each transaction has the transaction's creator in a Transaction's properties. This is the user name authenticated with HTTP to the service. This means that GeoServer has to be aware of all requestors. GeoServer can support pluggin of LDAP compliant services. GeoServer roles are limited to read, write, execute to specific services and layers.

WFS-T does not formally address authentication and authorization.