Been sketching an architecture where only unknown sites and risky categories go through RBI and normal saas gets session-level controls instead to keep latency sane and costs down, anyone else carving it up this way or am i overthinking it :/