A guardrail that caps how many requests one user or IP address can make in a short window. On a login page, it stops attackers from rapidly trying thousands of passwords.