SAMPLE EVIDENCE for AU-04 (made-up app Tidyhaus; not a real review)

Attempts 1-10: HTTP 400 "Invalid login credentials". No limit reached at 10 attempts; the configured limit above passes the item.