Which IPv4 multicast technical component measure provides architectural security?

IGMP max groups limits the number of multicast groups a single host can join, which is a resource-protection measure against host-level abuse, not an architectural boundary control.

Access lists are policy-based security controls applied by administrators; they are operational controls that enforce intent but are not inherent to the multicast address architecture itself.

The administratively scoped IPv4 multicast address range 239.0.0.0/8, defined in RFC 2365, creates hard topological boundaries for multicast traffic. Routers at scope boundaries filter this traffic by default, preventing multicast streams from leaking outside their intended administrative domain - this is a built-in architectural security control rather than a policy overlay.

State limit restricts the number of multicast (S,G) or (*,G) entries a router will maintain, protecting against state exhaustion attacks, but this is a resource limit rather than an architectural boundary mechanism.