You can. There's the concept of query complexity as well that lets you simply reject queries that are too complex and likely to cause trouble.