Identify that internal System and Process APIs not exposed to untrusted callers can rely on client ID enforcement and network controls such as IP allowlist.