A retail company runs its e-commerce site behind an Application Load Balancer that is fronted by CloudFront. Competitors are using automated tools that mimic legitimate browsers to scrape product pricing in real time. The traffic volume from each source IP stays low enough to avoid tripping the existing AWS WAF rate-based rule, but the aggregate scraping is skewing analytics and degrading the recommendation engine. The security team must reduce automated scraping while allowing genuine users and known good bots (such as search engine crawlers). Which approach best meets these requirements?