Contact Authorization Belongs to Backend Policy, Not Dialing Logic
SIP addresses endpoints; the product still needs an explicit policy for who is allowed to contact whom.
authorization
Parent-Approved Contacts Are an Architecture Rule, Not a UI Filter
Contact approval has to be enforced by backend identity and call routing, not only hidden buttons.
One Hostname, Some Public Paths, Some Private Paths: Make the Boundary Obvious
Path-based access control is safest when protected and public branches cannot accidentally fall through.