Denis

The part people discover during the incident: stopping the process does not stop the side effects that are already in flight. Requests already sent complete, queued jobs still run, and anything with a retry keeps going without the agent.

So the ceiling matters more than the interrupt, because the interrupt is always late by however long your slowest in-flight call is.

Scoped throwaway credentials in a container is the only thing on the list that limits damage rather than duration.