Answer
On IBM i specifically, safe exposure usually means working through exit points and IBM's exit point registration framework so every access attempt through FTP, ODBC, or a custom API can be logged and controlled centrally, rather than relying only on object-level authority. It also means exposing curated Db2 for i views rather than physical files directly, so the API layer controls exactly which columns and rows are visible instead of inheriting whatever access the underlying file grants. Authentication should use tokens or certificates tied to individual service accounts, not a shared user profile, and QSECURITY level and object authority settings need to be reviewed as part of the design, not assumed to already be correct.
Rate limiting and logging matter just as much as the access control itself, since an unthrottled endpoint can overload a partition during a batch window, and a request with no audit trail is very hard to investigate after the fact. Buyers should ask any API platform vendor how they integrate with IBM i's native security model, including exit points and journaling, rather than accepting a generic answer about encryption and authentication that could apply to any platform.