Publish curated Knowledge Hub source from 2ed833f290b439a7bc91e5fd19b042c269e3bee9

docs/12-auth-security.md

@@ -186,6 +186,13 @@ At minimum isolate policies for:
 
 Return a generic response that does not confirm account/content existence.
 
+The knowledge and unified-search endpoints share a 60-request/minute budget per
+effective remote IP. Job creation and the compatibility backup-creation endpoint
+share a 10-request/minute budget. Both use zero-length queues and return 429.
+Forwarded addresses are accepted only from configured trusted proxies. Durable
+job admission additionally enforces per-actor, workspace and rolling daily budgets
+inside PostgreSQL; see [background jobs](background-jobs.md).
+
 ## Security verification
 
 Release requires: