Rate limiting (ops)
Limiting how many requests a client may make in a time period, to protect a service against overload, abuse, and unfair resource consumption. If the limit is exceeded, requests are rejected (often with HTTP 429 "Too Many Requests").
Mechanic: common algorithms are the token bucket (a bucket is refilled with tokens at a steady rate; each request costs a token, out of tokens = rejected — allows bursts up to the bucket's size) and the leaky bucket/sliding window (a smoother rate). The limit is set per client (IP, API key, user). Use case: protect against overload (a runaway client can't take down the service), fairness (one customer can't consume all the capacity from others), abuse protection (slow down brute-force, scraping, DoS), and quota management (a free tier vs paid). Distinct from backpressure (internal flow control between components) — rate limiting is usually an external limit at the entrance (an API gateway, a reverse proxy, the mesh). Related: throttling. A fundamental protection and fairness mechanism. Related to backpressure (ops) and circuit breaker (ops).