Specifies authentication, authorization, rate limits, idempotency, retry, timeout, and failure-isolation rules for import and export. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.