Different endpoints have different policies

/private uses auth, only you can access
/chat uses auth, only your WoT can access
/inbox only your WoT can write, anyone can read
/outbox only you can write, anyone can read