9.46System API security
Suppose the Salesforce System API is internal.
Don't assume:
internal = no security
You may still need:
client authentication
authorization
rate limits
network restrictions
auditing
because internal consumers can cause plenty of damage.