Prohibited activity categories
- Unauthorized access, credential abuse, malware, destructive automation, and service disruption.
- Illegal content or activity and infringement.
- Deceptive identity, spam, harassment, and non-consensual surveillance.
- Collection or processing of data without required rights and notices.
- Attempts to bypass tenant, quota, billing, region, or security controls.
Technical limits
The production policy should incorporate documented payload, depth, traversal, concurrency, search, storage, and rate limits. Emergency controls must preserve export, deletion, and security operations where safe.
Enforcement and appeal
Define notice, suspension, emergency action, evidence preservation, remediation, appeal, and termination procedures. Security suspensions should fail closed and be modeled with deny-wins semantics.