As I said, we won't let them doing that, as this line should stop them https://github.com/ehelms/katello/blob/refs-5217/app/controllers/katello/api/v1/candlepin_proxies_controller.rb#L402 (provided there will be deny_access instead of false)