A threat-modeling exercise identifies a public API trust boundary but no authorization check before sensitive operations. What risk factor is being identified?

1. A vulnerability in the control design at the boundary
2. A realized financial loss
3. A fully effective compensating control
4. A risk-acceptance decision