[jamesrr39]

presumably there is still some authorization requirements though? The logged in user is authorized to see details about Friend 123, but not about Non-Friend 456?

[andrelaszlo]

That might be what they meant by "robust permissions model".