OAT-005 Scalping bots don't trip WAF rules because every request is individually valid. The attack lives in session behavior. Here's what detection and enforcement look like from inside the application.