Bot mitigation has an asymmetric structure. The application is where malicious behavior is easiest to detect.


“This account has seen 30 failed login attempts in five minutes.”
“A human user would never call these APIs in this sequence.”


Only the application has that kind of context.

On the other hand, the edge is where enforcement is easiest....