Rate limiting

Rate limiting is admission control with a price tag attached. The cost structure makes it a design question rather than a protection feature: an arrival refused at the gateway with a clear status costs nothing, while the same arrival admitted into a saturated pool holds a KV cache seat and lengthens the wait of every request behind it. So the limiter exists to spend refusals early and cheaply instead of wait time late and universally.

The token bucket is the standard mechanism, and its two numbers are the design. The refill rate is the steady budget - how many arrivals per window the tier may spend. The bucket capacity is the burst budget - how much of that allowance can be granted instantly when a burst lands, which is what keeps a short burst of legitimate traffic from being punished by an empty refill. Holding the bucket in a shared store keeps the decision atomic when many gateway instances admit concurrently.

Setting the rate is a product decision wearing arithmetic. Admitting near full demand keeps users happy until pool utilization closes on saturation, where wait time explodes; tightening the bucket rejects more arrivals at the edge and buys back a queue that drains. The honest version states the chosen share, measures the refused share, and revisits both after every incident - a limiter set once and never measured is a guess with a name.

A free tier sees 1,200 arrivals per minute at peak. The gateway admits 30 percent of demand through a token bucket that holds up to 40 tokens and refills at the admitted rate.

1. Refill: 1,200 x 0.30 = 360 tokens a minute, 6 per second - the steady grant for the tier.
2. A 2-second burst of 90 arrivals collects 12 refill tokens while it runs: the stored 40 plus 12 grants 52 arrivals, and 38 are refused.
3. The same 38 admitted into a saturated pool would queue at super-linear wait cost - the refusal is the cheaper outcome for everyone already in line.

A bucket of 40 refilling at 6 per second grants 52 of a 90-arrival burst and refuses the rest at the door - the shaped share, written in two numbers.

Where this shows up

• Design ChatGPT: Tiers & Rate LimitsDesign ChatGPT is the most-cited systems design question at AI companies, and it is really one question: when everyone arrives at once, who gets served, who waits, and who is told no, all without the paying tier ever noticing. The answer interviewers grade against has three parts. First, three pools: a small provisioned pool whose cards exist for one tier only, a larger shared pool where paid requests carry priority over free ones, and the queue itself, which lives in card memory, not in a message broker. Second, a token-bucket rate limiter at the gateway, held in Redis for atomicity under concurrent writers, that admits free arrivals at a chosen share of demand and reconciles the token count after each grant, so a burst of arrivals is answered instantly without consulting a GPU. Third, shedding: a request refused at the gateway with a 429 costs nothing; the same request admitted into a saturated pool holds an expensive seat and lengthens every wait behind it, which is why the tail wait punishes utilization non-linearly, and why an incident that removes 30% of capacity can turn a 97 millisecond paid wait into an 850 millisecond one. Interviewers test this because every knob in the design is a money or trust decision: renting burst capacity for a launch day, tightening the bucket over a jammed pool, or letting the free tier shed so the subscribers do not notice an outage. The three challenges below work the mechanics: the admit count a token bucket grants, the queue wait the utilization formula quotes, and the shed arithmetic that keeps the shared pool from jamming.
• Serving AI ReliablyThe AI feature launched ten days ago and is the quietest thing you operate: the dashboard is a strip of green graphs, no complaints, nothing shipped this week. Then at 3am something changes, and running this feature is different because the dependency is a model you neither wrote nor can restart: a provider answers your users, and the provider can change its capacity, its pricing, or the model itself without telling you. So the board grows meters that watch the call rather than your code. p95 latency, the wait that 95 of every 100 requests stay under, catches a capacity squeeze that the median wait, p50, smooths right over. The error share catches a rate limit, a provider ceiling on how many calls fit in a minute that a launch surge can trip with zero code changes. Daily spend catches a prompt edit that quietly broke the prefix cache, the discount a provider grants while your requests resend the same opening text. And an eval set, a small fixed list of prompts with expected answers that your code reruns on a schedule, catches the scariest one: a silent quality drop after the provider swapped the model, the failure users notice and no latency meter ever blinks. What you do about it is the fallback ladder, an ordered list of answers to serve while the model misbehaves: retries with backoff first, then a smaller or older model, then a cached reply, ordered so the user meets slow long before they ever meet gone. Pinning, writing the exact model version into your config instead of floating on the provider default, is what turns a swap back into a rollback. Interviewers ask what you watch and what you do at 3am: a specific ladder is the answer of someone who ran a live AI feature, and we would monitor things is the answer of someone who has not. The three challenges below grade exactly that: the order you triage a crowded alert board in, the p95 and eval math that tells you to roll a model version back, and the share counters that say whether the ladder is holding.

Related terms