Rate limits protect availability. They do not decide whether this caller may read that customer's invoice.
A client that stays under 100 requests per minute can still be unauthorized on every single one of them. Throttle abuse separately from checking actor, object, and action — and never treat "not rate-limited yet" as an allow.
Top comments (0)