This is a good question. I think a more general feature it's lacking is auditing (as far as I've been able to find), from which you could judge whether a user w

This is a good question. I think a more general feature it's lacking is auditing (as far as I've been able to find), from which you could judge whether a user was abusive and revoke permissions. There's profiling tools, which you may be able to hack together something for auditing if you were so inclined: https://firebase.google.com/docs/database/usage/profile https://firebase.google.com/docs/database/usage/profile