Housing chatbot capacity collapses after scrapers flood token-heavy requests. Which vulnerability-management response best addresses this AI threat?

Housing chatbot capacity collapsing after scrapers flood token-heavy requests is best addressed by applying rate limiting and abuse controls that protect AI capacity from token-exhaustion scrapers. That response works because generative assistants meter cost and availability in tokens and concurrent inference; without quotas, per-identity limits, anomaly thresholds, and bot challenges, scrapers can deny service to residents seeking housing assistance while inflating municipal spend. Deploying input validation and prompt filters that screen token-heavy scraper queries for injection fails because those controls only inspect content for injection, but they still allow high-volume benign queries through and do not throttle volumetric token-exhaustion scrapers or enforce quotas, per-identity limits, and anomaly thresholds needed to protect AI capacity. Requiring mutual TLS authentication between clients and servers to block token-exhaustion scraper traffic fails because it only verifies client identity at connection setup; it does not throttle token consumption, enforce quotas, or stop authenticated scrapers from flooding volumetric requests at the public chatbot edge. Enabling token-usage audit logging and capacity dashboards that track token-exhaustion scraper consumption patterns fails because it only provides visibility into consumption after it occurs; it does not throttle scrapers, enforce token budgets, or prevent capacity collapse in real time. Exam caveat: rate limits must spare legitimate high-need residents (for example, emergency housing triage) through tiered policies rather than blunt global caps that create inequitable denial. Operational check: define per-user and per-IP token budgets for the housing chatbot, alert when burn rate exceeds baseline, and document exception paths for authorized bulk civic workflows before enforcing blocks.