Authentication should be required for registering a new phone, changing the phone's user, changing settings and accessing voice mail.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.