You are right. We will let it be and scale up/out if needed.

Similar to @Neil, I am going to look into Windows Firewall to see if this is configurable for an inbound rule that is not coming from local.

Our security model is locked down. Our issue is coming in when users are loading/deleting/moving content that they already have access to do in the interface. The scale that they can do it with in CoreService is what we want to lock down.

We use Windows AD for authentication, so unfortunately I do not think this will not work.

We were adding things before the user sees the job. We will forgo this for now, notify the users and use some JavaScript. @yuri-bondarchuk, put this request on the ideas page to be looked at for the next release?

@AlvinReyes, thank you for the links but I guess there are levels of "legacy". We are about as legacy as it get until the old publishing framework is removed. I found a solution below and will reply if the vendor does.