A housing-authority eligibility model API has no rate limits, allowing bulk querying that could support model extraction. What should the auditor recommend?

Implementing rate limiting and abuse monitoring to reduce model-extraction and API abuse risk emphasizes protecting housing-authority eligibility model APIs from bulk querying that reconstructs behavior. The correct recommendation works because unlimited, high-volume queries enable adversaries to map decision boundaries or approximate the model, increasing privacy, fairness-gaming, and intellectual-property risk for municipal eligibility systems. Rate limits, authentication, anomaly detection, and query-pattern monitoring shrink that attack surface.

Publishing feature importance summaries in the transparency report fails because explaining eligibility decisions does not restrict bulk querying or stop adversaries from reconstructing the model; transparency alone leaves the API open to extraction and gaming. Enabling detailed request logging in the SIEM still does not rate-limit or flag the systematic, high-volume querying that enables model extraction in real time; retrospective logs can confirm abuse happened after the fact but do not stop it from happening. Issuing authenticated API keys to housing partners fails because authenticated access is not the same as access control; without rate limits and abuse monitoring, partners can still issue the high-volume queries that enable bulk model extraction against civic APIs.

Exam caveat: rate limits alone are incomplete if authenticated insider accounts can still scrape at scale without behavioral monitoring. Operational check: enforce per-identity quotas, alert on systematic boundary-probing query patterns, retain API abuse telemetry, and periodically review whether eligibility API exposure still matches the housing authority's need-to-query principle.