Teams
Each team gets a budget and guardrails. They apply at admission and at runtime.
How guardrails apply
Admission rejects manifests that use a blocked scope, exceed the agent limit or ask for a disallowed isolation. At runtime the tool gateway checks the same rules before every call, so a guardrail added today also stops fleets that are already running.