A housing authority exposes a tenant chatbot API. Which preventive control best fits that endpoint?

Tuning rate limits and quotas on tenant chatbot APIs is the preventive control that fits a housing-authority public endpoint: unconstrained APIs invite scraping, credential stuffing, denial-of-wallet token burn, and service degradation for legitimate tenants. The correct control works by bounding request rates and quotas per identity, key, or IP class so abuse is throttled while ordinary tenant use continues. Enforcing message encryption on tenant chatbot APIs fails as a preventive control for this endpoint because encryption protects confidentiality in transit, not traffic volume; it does not throttle requests, enforce quotas, or stop denial-of-wallet token burn before legitimate tenants are affected. Requiring model watermarking on tenant chatbot APIs fails as a preventive control because watermarking only marks outputs for provenance after generation; it provides attribution but does not bound request rates or stop automated abuse in real time. Applying output bias testing on tenant chatbot APIs fails as a preventive control for this endpoint because bias testing addresses model fairness, not API traffic; it does not throttle scraping, credential stuffing, or denial-of-wallet attacks. Exam caveat: limits must be set from observed tenant usage plus headroom—overly aggressive throttling can block legitimate peak demand during housing crises or application windows. Operational check: enforce authenticated keys where appropriate, configure per-client rate limits and daily quotas, alert on limit storms and cost spikes, publish tenant-facing guidance for normal use, and load-test that legitimate peak traffic still succeeds under the tuned caps.