No inflated marketing — explanations of how the WAF actually behaves in code.
Reporting mode learns Method + URL only.
Scoped skip and UI labeling — not global SQLi off.
Phased modes before enforcement.
Pipeline step 7 and honest L3 limits.
Who decides Allow / Block — and who does not.