A network automation team exposes a REST API on a Catalyst Center appliance to internal scripts. During a scripting error, one client sent thousands of requests per second, degrading the controller's responsiveness for other clients. The security architect wants a control that protects the API from being overwhelmed by excessive requests from any single client without blocking legitimate access entirely. Which REST API security mechanism directly addresses this concern?