[Ballot discuss]
Most of these are based on the secdir review from Vincent:

0) Are there any additional recommendations this document should be making
wrt devices not implementing the default security policy recommended
by [IGD2]? There's this text in IGD2 that makes me a little happier:

The InternetGatewayDevice MUST support IGD Specific security as
defined in section 2.3, but MAY implement stricter security policy.

But then, there's this bit in s2.3 that seems to be a bit contradictory:

This document RECOMMENDS the default access level to be applied for
each action of the legacy services (version 1 and version 2). In other
words, this document does NOT REQUIRE that a vendor MUST implement the
access level defined in this document for each action of his
InternetGatewayDevice:2 implementation. As a result, vendors are allowed
to implement different access control policies than defined in this
document. For example, a vendor can decide to set a Public access level
for opening port mappings with ports lower than or equal to 1023 instead
of a Basic access level.

1) My assumption is that your models are the 3-box models because you
want access control applied based on the SHOULD [IGD2]. But, I really
can't tell.

2) I think the bit about:

Means to prevent a
malicious user from creating mappings on behalf of a third party must
be enabled as discussed in Section 13.1 of [I-D.ietf-pcp-base].

The reason IGD2 is the SHOULD because then you've got ACLs - right? But,
in reality is the LAN trusted almost all of the time?

3) In s7, please elaborate on why it's SHOULD NOT:

When only IGD:1 is available, operation on the behalf of a third party
SHOULD NOT be allowed because there's no authorization supported in
IGD:1.

That's my suggestion, but doesn't the desire to have IGD2 because of it's
authorization model mean that maybe this protocol isn't applicable to IGD1?