I find it strange and confusing that ".indexOn" rule does work with Service Account over REST, while ".read" and ".write" rules are totally ignored. I would like to enforce Firebase checks, such as "exists()", before any data is written to the database. I have many servers and cloud functions talking to the database over REST concurrently, so I cannot check for conflicts on the server side.