[sealedmailuk]

Interesting approach. The Lambda cold-start tradeoff is real but for untrusted code isolation it is hard to beat the security boundary. One parallel: DMARC enforcement works similarly - it is a hard boundary at the DNS level rather than trying to inspect and filter, which tends to be more reliable than heuristic approaches.