Just think about what has to happen and make sure that it can happen:

Outbox -- Make sure you can write to it (subscriptions/AUTH are ok).  Make sure everybody can read from it (without needing a subscription or AUTH).
Inbox -- Make sure everybody can write to it without a subscription or AUTH, at least in so much as when they tag you.  And make sure you can read from it (subscriptiuon/AUTH are ok).