I think CRDTs necessitate a robust permission system to be more than a toy.

If you want a decentralized CRDT, you'd probably end up re-inventing smart contracts (which is what I found myself doing once).