Per-service maintenance (engine.enable_service_maintenance): puts all routes of one service into maintenance mode at once without affecting other services. SDK clients with a matching app_id receive the sentinel over SSE and treat every request as if their own global maintenance were enabled. Supports reason, exempt_paths, and include_force_active, the same parameters as all-services global maintenance. Controllable via the new shield sm CLI command group (status, enable, disable), the REST API (POST /api/services/{service}/maintenance/enable|disable), and the dashboard Routes page (service maintenance card, shown when a service filter is active). Audit log actions: service_maintenance_on and service_maintenance_off.

Per-service global rate limit (engine.set_service_rate_limit): a rate limit policy scoped to a single service name that applies to all routes of that service. Sits between the all-services global rate limit and per-route limits in the enforcement chain, requests are checked in order: global maintenance, service maintenance, global rate limit, service rate limit, per-route rate limit. Configurable from the dashboard Rate Limits page (service RL card, shown when a service filter is active) and the new shield srl CLI command group (get, set, delete, reset, enable, disable). Uses GlobalRateLimitPolicy — the same model as the all-services global rate limit. Persisted in the backend via a sentinel key so the policy survives Shield Server restarts.