* Take a look at this blog post [0]. That can cover a lot of different security scenarios. The next step would be linking in an external system (database, API, etc) to better track more complex security policies.

* Standard Varnish usecase, nothing extra needed.

* https://github.com/varnish/varnish-modules vsthrottle

[0] https://info.varnish-software.com/blog/using-varnish-cache-s...