Business logic is designed for a person: browsing, selecting, entering payment, waiting for confirmation. The flow takes 2–5 minutes for a human. A bot completes it in milliseconds. No inventory reservation system, no purchase limit, no fraud detection was calibrated for millisecond completion. The business logic had no concept of “this is too fast.”

The checkout flow assumes one person is checking out. Bots run hundreds or thousands of parallel sessions — each holding tickets in a cart, each completing the checkout independently. The per-session limit is fine; the absence of a per-account or per-identity limit is the gap.

Authentication, rate limiting, and fraud detection focus on unauthorized access. Business flow abuse is authorized — the bot has a valid account and a valid payment method. Traditional security controls don’t catch it because the requests are technically legitimate. The problem is the intent and the scale, not the authorization.