There is a problem with Differential: anyone can create a diff and a revision and there is no Default Edit Policy for revisions, so on installs where task creation and editing are restricted, spammers will target Differential revisions and may create trash diffs.

That's why it would be nice to add the ability to change the Default Edit Policy for Differential revisions as well as restricting who can create diffs (for revisions) by adding a Can Create Diffs policy.
An example use case would be to restrict the ability to create diffs and edit revisions to Trusted Contributors on this install.

A similar approach to Can Create Diffusion Repositories and Default Diffusion Repository Edit Policy can be used to implement the aforementioned policies for Differential.

For now, a global Herald rule blocking unauthorized users from editing revisions is the best way to restrict their ability to edit revisions. The same goes for creating diffs.