SAMPLE EVIDENCE for AU-04 (made-up app Tidyhaus; not a real review)

Authentication > Rate Limits (owner's screenshot described): sign-ins and sign-ups 30 per 5 minutes per IP; token verifications 30 per 5 minutes.