Which assumptions do you think break first? Are you concerned about data exposure, unauthorized actions, provider terms, or something else?

What would you change?