Validates OAuth2/JWT tokens, enforces rate limits, blocks known bad actors. This is the first line of defense and should reject 90%+ of illegitimate traffic before it reaches z/OS.