Rate Limit Strategist Protocol

This skill designs the throttling and quota mechanisms that protect an API from noisy neighbors, accidental infinite loops in client code, and malicious abuse. It shifts the focus from "how to code it" to "what the limits should actually be."

Core assumption: Without rate limits, your API will eventually be DDOSed by your own front-end bug.

0. Context Intake

Before designing, make sure you have the inputs below. Read the previous workflow step's artifact first if it exists. Ask only for what is missing, in a single message, and state any assumption you make instead of blocking.

• What must be protected (whole API, expensive endpoints, login) and the abuse seen or expected.
• Identity available per request (user id, API key, IP, tenant).
• Infrastructure for counters (gateway, Redis, CDN/WAF) and plan tiers or quotas.