API Gateway Platform  ·  View 14 of 21  ·  Runtime

Quota Enforcement

Four scopes, one verdict, and a rejection the caller can act on.

Editable source SVG draw.io All views
Resolve Principal cred, app, tenant, tier Effective plan tier + override Evaluate — all four must pass Per credential burst rps Per application sustained / hour Per tenant plan ceiling Per route protects an upstream Count Local bucket admits optimistically Shared counter ≤ 2% overshoot Concurrency slot long-running routes Pressure test Global overload? fleet saturation Tier-aware shed free → paid → enterprise Verdict Allow forward 429 typed names the scope Tell the caller Limit headers on every response Retry-After computed, not guessed Account Access record allows and denies Billable usage from records, not counters rejections counted reconcile Quota Enforcement — Four Scopes, One Verdict Application we own Decision point Data store Opportunity Risk / gap Queue / topic event / async Counters are approximate and are never the billing source. Billing is derived from access records, which are durable. v 1.0 · owner Integration Platform Architecture · date 2026-09

Decisions

  • All four scopes must pass. A request satisfying its credential limit while its tenant is over its plan ceiling is refused, and the error says which.
  • Local buckets admit optimistically and reconcile against the shared counter, which is what buys the ≤ 2% overshoot at a 5 ms budget (ADR-05).
  • Shedding is by plan tier and is recorded — a free-tier caller shed during an overload should be able to see that it happened.

Numbers

  • ≤ 2% overshoot at p99 for shared counters; hard plan ceilings exact within 1 s (assumptions).
  • Limit headers on every response, not only on 429, so a well-behaved client can pace itself before it is refused.

Risks

  • A hot tenant can saturate a counter shard. Sharding by principal rather than by route is the mitigation, and the shard key is the thing to re-examine when a single tenant exceeds a few percent of global traffic.
◀  Degradation Paths All views Revoking a Leaked Credential  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-09 · 21 views · 18 architecture decision records14-quota-enforcement