There is no specific security policy recommendation for the RecommendContent Web service; it is assumed that you want all users to whom the targeter or slot applies to be able to call this service.