Jeez. Surely the ECS agent could just query for permission to join a cluster, and disable if disallowed?