Would it make sense to not have policies or webhooks be 'per group' ? 
What if they're absolute limits across the product? Would that be simpler and more effective at preventing abuse?