An API rate limit reduces abusive traffic but does not validate whether a user may read a particular account. What remains necessary?

1. Object-level authorization for the requested account
2. Only a longer endpoint URL
3. Only a higher request limit
4. Only a stronger TLS cipher