being able (possibly with a policy) to limit request and / or response payload size.
This should be possible by manipulating the 2 parameters:
client_max_body_size
body_bytes_sent

Could be helpful as a security measure against DoS as well as improper usage of some APIs