What is a common mistake with rate limiting and WAF integration in Ingress?

Relying on ingress rate limiting as the only abuse control ignores identity-specific and business-level limits inside the API.