Glossary
Rate Limiting
Rate limiting caps how frequently a caller can make requests — a defense against a different problem than authorization solves. An authorized caller can still be rate-limited if it calls too often; an unauthorized caller gains nothing from a generous rate limit, because it never gets past the authorization check in the first place. The two controls answer different questions and neither substitutes for the other.
The confusion arises because both controls can produce the same visible symptom — a rejected request — which makes it tempting to treat a rate limiter as a security control on its own. It is a useful control against abuse and denial-of-service patterns; it does not decide whether a given caller should be allowed to perform a given action at all.