Design brief
Design shared API admission for 50,000 requests per second and one million active clients per minute. Each authenticated client receives 100 requests per minute across all gateways. Begin with fixed windows, state the allowed boundary burst, and choose a decision latency budget. Define separate outage policies for expensive job submission and cheap public reads.
Draw and explain
In Excalidraw, label gateways, policy ownership, quota state, and the protected application boundary. Draw allowed, limited, and unavailable request paths, including where identity and trusted time originate. Explain the atomic admission decision and the meaning of remaining-budget and retry guidance. Estimate active-state memory and state operations per second; show where adding gateways increases load elsewhere.
Stress the design
Two gateways receive a client's final permitted request concurrently. Walk through the observed decisions. Then let the quota dependency time out after possibly recording an admission. Explain whether a retry spends another token and how the client distinguishes unavailable service from exhausted quota. Show how the expensive endpoint remains protected during this uncertainty.
Review your design
Compare strict shared decisions with local token leases: quantify the availability, overspending, and unused-capacity implications. Explain when fixed-window bursts justify a different algorithm. Check policy rollout, clock skew, identity cardinality, and one abusive hot key. Choose signals for bypassed decisions, limiter latency, throttling, and downstream saturation.
Capture assumptions, sizing, and the tradeoffs behind your diagram.
Review is your own assessment of the design.