All call flows that can make internal or external calls, transfers or other potential call operations must ensure only the expected call destinations from valid users are allowed. All possible invalid operations should be detected and prevented by the use of call flow logic.