Concept
Silence on auth never reads as open
Each action declares its auth (none / api-key / oauth2 / delegation/1); an omitted auth is refused, never interpreted as “anyone may call”.
Pinned to
agent/1 — the discovery documentThe canonical source this concept is taught from. If it moves, the lesson is regenerated — teaching is pinned to code, not retyped.
On the frontier
No course teaches this concept yet — it is a named gap on the content graph, not a hole nobody sees. A gap is the roadmap, not an embarrassment: the count only falls by teaching.