How would you answer an interview scenario involving rate limiting and WAF integration in Ingress?

One client floods an API behind ingress. Explain where global, client-specific, and business-level rate limits belong.