A global request limit protects total capacity but does not guarantee fair service. A large tenant may consume most workers, database connections, or queue slots. Use per-tenant quotas, concurrency caps, weighted scheduling, and workload isolation where necessary.

Use hierarchical controls: tenant cap, user cap, endpoint cost, and service-wide emergency limit. Expensive operations should consume more quota than cheap reads. Return documented retry guidance and quota headers when appropriate.

Test hot limiter keys, clock boundaries, Redis failover, and fail-open/fail-closed behavior. Monitor rejection rate by tenant, queue delay, and resource use so limits can be tuned from evidence rather than arbitrary defaults.