Any object that can be referenced in the database should support ref-nfy.
AFAIK only org objects allow ref-nfy.
Person objects can be referenced by anyone anywhere with no authentication.
Bonus task, require mnt-by or mnt-ref to be able to add references to any object of any type?