A layer calls only the layer below it. The single exception is Accounting, which is fed asynchronously from Decision and Egress and never called back by them — that keeps billing off the latency budget.
Control is a peer of Decision, not above it. Policy arrives by push; the decision path never calls the control plane synchronously, which is why a PostgreSQL outage cannot stop traffic.
The Algorithm Engine is a strategy, not a fixed implementation. Token bucket ships in V1; sliding window is selected per policy row without a code change (FR2).
Numbers
Seven layers, 28 capabilities. Every capability maps to at least one functional requirement in the brief.
Lease refill interval 250 ms — short enough that a policy change takes effect within one window, long enough to keep Valkey traffic at 8% of decisions.
Policy cache holds the full tenant set in roughly 40 MB per pod at 5,000 organisations.
Risks
Reason & Retry Builder is load-bearing for client behaviour. A wrong retry_after turns a rate limit into a retry storm; it is derived from the limiting scope's window, never from a constant.
Provider Adapters are the layer most likely to churn, since each vendor changes its usage block format independently. Contract tests per adapter are mandatory.
