I am not aware of any limitations on this and I've also asked the Kibana security team about it and they said there shouldn't be any limitations to that. Can you give us more details on how you're implementing this? Is it a custom one or just overwriting an existing one?