The profile precedence chain is useful, but startup validation only covers values already known at startup. Request-level overrides arrive later and can still produce an invalid or unexpectedly expensive effective profile even if every named YAML profile is valid.

I would validate the fully resolved configuration per request, including bounds on top_k, candidate depth, and context budget, while keeping authorization constraints outside the override mechanism. Recording that resolved profile with the retrieval trace would also let you reproduce a result without guessing which defaults and overrides were active when it was served.