Deferred 2026-09-24: SPICE is served on one LAN address, so Intranet/Extranet/Internet zones and Alternate Access Mappings would be declarations that change nothing (a knob wired to nothing). Pick it up when a second URL exists - a public catalog or a partner extranet - and make the zone decide the anonymous level where AppPrincipalResolver/ListPermissionGate resolve it today.