A pod does not enforce the quota; it enforces a lease it was granted from the quota. The shard is the only place the full quota is known, so the sum of outstanding leases can never exceed it.
Leases are demand-sized. A pod that used 34 of its last 40 gets a larger grant; one that returned most of its grant gets a smaller one. Static division by pod count wastes quota when traffic is uneven, which is the normal case.
The stated tolerance is ±2% overshoot for standard tenants; measured at 0.9% with 60 pods against a 500 rpm quota. Tenants that require strict enforcement are configured to bypass leasing and hit the shard on every request, paying about 6 ms p99 instead of 0.3 ms.
Where overshoot comes from
A pod that dies holding an unreturned lease. Bounded by one lease per pod per 250 ms window, and the lease expires on its own.
Clock skew between pods and shard, bounded by NTP discipline to a few milliseconds against a 250 ms window.
Nothing else. There is no path by which two pods can be granted the same capacity, because the grant is an atomic decrement on the shard.
The trade being made
Strict global accuracy would require a synchronous coordinated decision per request, which is a 6 ms floor and a hard dependency on the shard being reachable.
The design chooses bounded, measured, per-tenant-configurable inaccuracy in exchange for a 20× latency improvement and graceful degradation.
The tolerance is a policy field, so a regulated tenant and a free-tier tenant can hold different positions on the same platform.
