You enforce a rate limit of 100 requests per minute per user at the edge, across 40 locations. Abuse monitoring shows a user making 3,000. Explain.

What the interviewer is testing

Whether you recognise that a limit enforced independently at many locations is not the limit you specified.

The explanation

Each edge location enforces the limit against its own local counter. A user whose requests are distributed across locations — by anycast routing, by using multiple networks, or deliberately — gets 100 per location. Across 40 locations that is 4,000.

Nothing is broken. The design assumed a shared counter that does not exist, because a shared counter is exactly what edge deployment avoids.

The options

Local limits sized for the aggregate. If you want 100 total and traffic is roughly evenly distributed, set a much lower local limit. Simple, and it penalises legitimate users whose traffic happens to concentrate in one location.

Approximate global counting. Edge locations report counts to a central store periodically and adjust local budgets. Bounded inaccuracy, modest latency cost, and it is the usual production compromise — deliberately accepting a margin of error in exchange for keeping the fast path local.

Two-tier limiting. A generous limit at the edge to stop volumetric abuse cheaply, plus an accurate limit at the origin for anything that matters — quota enforcement, billing, fair use. The edge handles volume; the origin handles correctness.

Central enforcement for the specific limits that must be exact, accepting the round trip. Suitable for a small number of high-value limits, not for general traffic.

The recommendation

Two-tier. Edge limits protect infrastructure and are approximate by design; origin limits enforce the contractual or security-relevant limit and are accurate. Be explicit in the design about which limits are which — the failure here is treating an approximate control as an exact one.

What a strong answer adds

The general edge principle this illustrates: anything with a global invariant does not belong at the edge without coordination. Rate limits enforced as a hard cap, inventory counts, uniqueness constraints and balances all fall into this category, and each is discovered the same way — during an incident.

Common weak answers

Reducing the local limit without addressing distribution. Concluding the edge platform is faulty.