One issue I keep noticing is that most anti-bot systems optimize for blocking instead of increasing friction progressively.

Rate limits tied to behavioral patterns rather than identity seem to work better — especially interaction timing, navigation flow, or session consistency.

We experimented with something similar while building HiveHQ and found bots usually fail when systems require small contextual actions humans do naturally.