Admission rules are cool but it would be great to know which ones people are using. It would also be great if the platform had a set of known bad SPL which could be toggled on. Here's a couple of obvious ones we've started with:
Prevent users searching all indexes: search_type=adhoc AND index=*
Prevent users using all time searches: search_type=adhoc AND search_time_range=alltime
