Adaptive rate limiting that learns your real traffic shape and tunes thresholds per IP, identity and endpoint — absorbing brute force, credential stuffing and L7 floods while real users never hit a limit they shouldn't.