Given a non-functional requirement (throttle traffic, block bursts, enforce registered apps, validate tokens), select the correct OOTB API policy: rate-limiting, spike control, client ID enforcement, or JWT validation.