A gateway can centralize routing, TLS termination, request size limits, authentication checks, rate limiting, and observability. Domain authorization and business invariants should still be enforced by the service that owns the resource; gateway-only authorization can be bypassed by alternate paths.

Because a gateway is on many request paths, run redundant instances and make configuration changes safely. Define behavior when identity or policy services are unavailable. Cached authorization decisions require explicit freshness and revocation semantics.

Retries at the gateway can duplicate non-idempotent requests and multiply load. Propagate deadlines, correlation IDs, and safe error formats. Avoid exposing internal stack traces or topology to clients.

A fixed window is simple but permits bursts around window boundaries. Sliding-window logs are precise but consume more state; sliding-window counters approximate a rolling rate. Token bucket allows controlled bursts up to capacity while replenishing tokens at a configured rate. Leaky bucket smooths output.

Distributed limits require shared state or equivalent coordination; per-instance counters can be bypassed by routing requests across replicas. Redis scripts or atomic operations can check and update a token bucket without race conditions. Keys should include the correct scope—tenant, user, API key, endpoint—and expire to prevent unbounded growth.

Rate limits and concurrency limits solve different problems. A tenant can stay under a request-per-minute quota while occupying all workers with slow requests. Combine quotas, in-flight concurrency, and fair scheduling for expensive workloads. Decide whether limiter-store failure should fail open or fail closed based on risk.

A global request limit protects total capacity but does not guarantee fair service. A large tenant may consume most workers, database connections, or queue slots. Use per-tenant quotas, concurrency caps, weighted scheduling, and workload isolation where necessary.

Use hierarchical controls: tenant cap, user cap, endpoint cost, and service-wide emergency limit. Expensive operations should consume more quota than cheap reads. Return documented retry guidance and quota headers when appropriate.

Test hot limiter keys, clock boundaries, Redis failover, and fail-open/fail-closed behavior. Monitor rejection rate by tenant, queue delay, and resource use so limits can be tuned from evidence rather than arbitrary defaults.