I extrapolated this as anything that is in the mind (PIN, password, some secret) cannot be demanded, while anything outside of the mind, biometrics, geolocation, physical object (key) can.

Again, I am just a hairless monkey smashing rocks together. Consult experts.