The full set of version histories in the version storage, though stored in a single location in the repository, must be reflected in each workspace as a subtree below the node /jcr:system/jcr:versionStorage. This subtree must be read-only. That is, applications cannot alter this subtree through standard write methods; though the implementation can, of course, alter it as a side-effect of the application calling version-related methods.
The read-only status of this subtree should be enforced by the implementation as a matter of access control. As a result, the protected status of parts of this subtree (enforced as a matter of node type constraints) is not relevant since, in effect, the entire subtree is protected.
Though the general repository-wide version history is reflected in each workspace, the access that a particular Session gets to that subtree is governed by that Session's authorization (which is determined either by the Session's Credentials or an external authorization mechanism), just as it is for any other part of the workspace.
All nt:versionHistory nodes are found under /jcr:system/jcr:versionStorage, though there may be a structure of intervening subnodes that sort the version histories by some implementation-specific criteria.
The node type of the node jcr:versionStorage is left up to the implementation.