You are building a FastMCP server that exposes a `get_interface_stats` tool backed by RESTCONF calls to production switches. During testing, a misbehaving conversational agent repeatedly invoked the tool in a tight loop, generating hundreds of RESTCONF requests per second and overwhelming the management plane of a core switch, causing legitimate NETCONF sessions to time out. Which mitigation most directly addresses the security risk demonstrated in this incident?