@gsuberland@jaseg enforcement on that is trivial though. Does a domain have an aggregation already running? Deny. Does the requested aggregation has more than 256 buckets? Deny.
The only way to game these simple rules would be to have a million different domains and redirect each user to a different one. Which I mean, I guess is a way to abuse it, but I don't think we'll see a day where users are getting separated into a million different domains for this.