• Exceptions to this rule can be made on a case-by-case basis. Please contact us with your idea, so that we can discuss possible anti-abuse methods. Examples of exceptions are Quarry and PAWS.

In T152212#2845634, @valhallasw wrote:

• Exceptions to this rule can be made on a case-by-case basis. Please contact us with your idea, so that we can discuss possible anti-abuse methods. Examples of exceptions are Quarry and PAWS.

This where Quarry and PAWS are links to pages outlining their abuse mitigations from the description seems sensible to me.

I don't think either of these projects qualifies as "unauthenticated" in that in my understanding OAuth is used to authenticated the requesting users against metawiki before allowing new resources to be consumed. The mention of "wikitech" users specifically in the rules seems like it could be amended to allow for this SUL auth case. Gross violations of resource limits would likely still be attributed to Quarry/PAWS but if those tools can provide a means to get a more granular view of the requesting users and ideally a means to block accounts that are repeat abusers then we are in a reasonable place to protect the shared resources from abuse.

I take the term unauthenticated to mean end users are not directly authenticating to the resources under consumption, i.e. obfuscation of who is eating adhoc DB where who is always the LDAP or Labs user. I can already think of a few ways that definition is bad though :) It would probably be prudent for it to be termed arbitrary access to resources unauthenticated. Otherwise, every webservice in Labs is probably in peril. Arbitrary SQL or some such under the guise of a service account is in many senses an anonymizing proxy. It may come down to the barrier to SUL being meaningful here is we don't tie accounts back anywhere for sure to an LDAP user to my knowledge. I definitely agree the intention is to allow good multi-tenant behavior and reasonable response, but I think I disagree we are in a place to call SUL authenticated in the context of shared resource administration for now.

The existing rule was introduced with the edit summary "Apparently, one must say things that go without saying". Maybe @coren can clarify. My random guess is that somebody deployed or asked if they could deploy PHPMyAdmin. ;)

Policy is set by what's happening. The written form just attempts to capture that. The answer to the direct question is that Quarry and PAWS are de facto allowed to be hosted on Labs since they are currently and, as far as I know, nobody is objecting to them being hosted and available there. I've made this wiki edit to hopefully better reflect the reality: https://wikitech.wikimedia.org/w/index.php?title=Nova_Resource:Tools/Rules&diff=1726430&oldid=1267829.