Workspace:AllowChanges()

It’s so extremely vague that it’s in my opinion a bad idea in the current proposed shape.
You really don’t want clients to be able to modify the instance’s name, add/remove children, etc. all the time. At least, I don’t want to. You throw many of the advantages and protections filtering offers that way.
All I imagine being valuable is having special value-objects whose value can be replicated to the server and other clients from a specific (set of) clients, but only their value. Or some other way to have (lossy) fast client → server replication of values, just like how replication already works, but in a restricted way.
Allowing clients to only edit specific properties of a specific instance could also work, but it sounds way more complex and heavy compared to specific objects.