ReadonlyenabledWhether the current profile has it on. Always true in this draft; kept for the UI contract.
ReadonlyidOptional ReadonlylimitThe limit that applies in the current profile, when the mitigation has one.
ReadonlyproviderWhere it lives: in kehto, in kernl, or in both.
ReadonlysummaryOne or two sentences on what it protects against.
ReadonlytitleShort user-facing name. No protocol vocabulary.
A mitigation the guard applies, described for the user.