I was thinking that "only X orbitals may have an orbital device, and only those orbitals may build ships".

I should probably say that I have an automated host backup and message pane scraper in place that could help verify this limitation fairly easily (a small amount of work would let it check for orbitals with an "orbital" device, and compare with the "ships built" list. This could kind of be undermined by exploiting the SB build bug (i.e. build 99% of a whole pile of ships at a station (without completing any) and then move production there and complete them all in one year. But the scraper also pulls build queues, so even that could be easily checked (nothing but a new SB hull, TF or alchemy (lol) should ever be in an AR queue).

The AR would therefore be allowed to build "defenses" (ineffective as they may be) on their planets, as well as actually using their full size.