how to distinguish public vs private (entry-point vs internal) systems