Limits & kill switch
- Per-IP and per-credential rate limits
- Free quotas only — no billing
- Infra envelope ≤ $15/mo; safe submission formats only; fail closed otherwise
- Emergency execute kill switch (owner exceptional / automated abuse response)
- Audit log for sensitive actions
- Auto-suspend on continuous monitor signals