framework:
    rate_limiter:
        # OTP send-code: max 5 requests per hour per IP (prevents SMS flood)
        send_code:
            policy: 'sliding_window'
            limit: 5
            interval: '60 minutes'

        # Login: max 10 attempts per minute per IP (brute force protection)
        login:
            policy: 'fixed_window'
            limit: 10
            interval: '1 minute'