Rate Limiting: Why Does Permission Not Mean Unlimited Speed?

Rate limiting does not decide whether an action is permitted. It specifies how often that action may occur within a period. An account may be allowed to sign in, while hundreds of rapid attempts are still delayed or rejected: permission answers eligibility; rate limiting governs pace.

This matters because many systems can handle a steady flow of requests but not an abrupt surge. A common token bucket adds tokens at a stable rate and spends one for each action. The bucket's capacity permits a short burst, while its refill rate constrains the long-run average. Occasional concentrated use need not be banned, yet bursts cannot accumulate without limit.

Rate limiting is also distinct from backpressure. Backpressure tells an upstream process to slow down after downstream congestion is detected; a rate limit can set a boundary before congestion occurs. Nor is it the same as a total quota: one thousand uses per day concerns total volume, while ten per second concerns rate. Stability depends not only on what a system allows, but also on how quickly change may enter it.

https://docs.cloud.google.com/tasks/docs/configuring-queues