Finally sorted it out.
AJAX is used to initiate the auto-save in the background while the user edits the post. When the auto-save ID is returned, it's re-assigned to the wp.media object like this:
wp.media.model.settings.post.id = autos_save_id;
The permission issue I was experiencing came from the simple fact that my user role didn't have the 'edit_post' capability. Duh.