Supplement the note at lines 165-172 with a new paragraph: In the absence of other sources of information, implementations SHOULD generally view the absence of particular elements as implying that any values supported by the consuming implementation are acceptable, with the obvious exception of metadata elements representing roles, endpoints, keys, etc. (elements that cannot be "defaulted" or that would be security-sensitive if assumed). Alternatively, the presence of particular elements SHOULD generally constrain the choices made by the consuming implementation. Of course, if other sources of information are available, implementations are free to combine it with, or override, the information found in metadata, as appropriate to that implementation and deployment.