I always setup guard rails so that only zdr providers are used.