I propose to impose a limit so we reject if more than 10 IDPs are being requested, for performance / privacy.