Received the below from my Citrix team after asking them the question: Per the NS team, AAA_REQUEST policies will hit before authentication is complete, after that REQUEST policies are hit. AAA_request was created to rate limit authentication requests. Before the creation of this bind point, rate limiting policies wouldn't affect auth requests. Rate limiting could only be done for requests to the backend that's being proxied by the virtual server which is what the REQUEST bind point is for. https://docs.netscaler.com/en-us/citrix-adc/current-release/aaa-tm/citrix-adc-aaa-session-and-traffic-management/rate-limiting-with-gateway.html