Resolving this issue involves going through the handlers in the modules/ tree alongside the matrix client and server specification to flag methods required to be rate-limited. Currently some are, but many are not.

Example of a method with the flag:

resource::method
method
{
    resource, "GET", handler,
    {
        method.REQUIRES_AUTH |
        method.RATE_LIMITED
    }
};
`

Redfish does not provide option to specify group roles for a user. As per user management design - https://github.com/openbmc/docs/blob/master/user_management.md#openbmc---user-management---user-creation-from-webserver-flow---with-all-groups, we should be able to set different group roles for a user.

I check with development and found that its not in their current priority. I have opened this