Self-asserted, not password-protected -- picking a name here is what §7's RBAC calls "the interface", not the security boundary. Every action is still re-checked against your role on the server.