I like the guidelines you suggested. I'd probably add a requirement for multiple failsafes, which you alluded to in the "self deactivating" bullet. Like they can receive a shut off signal, but also have a countdown timer that shuts them off after a given time period....