---
type: Axis
title: quota (resource-bounding axis)
description: The quota/resource-bounding architecture axis — how a consumer's use of a resource is bounded (unbounded → rate-limited → quota'd → reserved-capacity). A system-singleton axis whose commitment surface is the interface/wire contract (the consumption limit the API advertises and enforces). DEEP (RFC #75 5A.5 / P1 #851); worked example is the parallel-agent loadavg starvation and the daemon SSE/health resource limits.
tags: [axis, architecture, quota, rate-limit, capacity, throttling, fairness, rfc-75, deep]
timestamp: 2026-06-20T00:00:00Z
---

# Quota (resource-bounding axis)

> **DEEP axis (P1 #851).** Full §6 depth with a worked example from the skill's
> own history — the parallel-agent loadavg starvation (5-wide bazel drove
> loadavg to 32-72 and starved the daemon) and the cap-parallel-agents
> discipline. Distinct from `recovery` (handling a *failed* call) and
> `consistency` (reconciling concurrent *writes*): quota is how much of a finite
> resource a consumer is *allowed*, enforced before the work runs.

## Concept

Quota is the **resource-bounding** axis (RFC #75 §3): how a consumer's use of a
finite resource (compute, connections, request rate, storage) is bounded. The
ladder runs unbounded (no limit; a single consumer can starve all others) →
rate-limited (a per-window cap: N requests/sec, smoothing bursts) → quota'd (a
per-consumer allocation over a longer window, with fairness across consumers) →
reserved-capacity (a guaranteed floor *and* ceiling per consumer; capacity is
provisioned, not just throttled). Its **commitment surface is the interface/wire
contract** (§4): the limit is advertised on the API (a `429`/`Retry-After`, a
quota header) and callers build backpressure on it; tightening or removing it
later breaks callers' assumptions. Its **scope is system-singleton** (§5): the
bounding stance is a system-wide property of how the resource is shared.

## Why it is an axis (discriminator test — §2)

1. **Ordered tiers** — each rung adds a stronger, fairer bound (unbounded ⊂
   rate-limited ⊂ quota'd ⊂ reserved).
2. **Cross-cutting bundle** — a rung dictates the wire contract (limit headers,
   `429`), an accounting/counter store, an admission-control check on the hot
   path, the fairness policy across consumers, and the load/starvation tests.
3. **Asymmetric migration cost** — adding a quota to an unbounded API forces
   every caller to handle backpressure; loosening it is easy but tightening it
   later breaks consumers that grew to depend on the slack.
4. **Requirement-keyed selection** — falsifiable probes (below) pick the rung.

## Tiers (the ladder)

| Tier | Adds | Commitment surface | Forecloses next-cost |
|---|---|---|---|
| `unbounded` | nothing | interface-wire-contract | trivial → add a rate limit |
| `rate-limited` | per-window cap | interface-wire-contract | low; no per-consumer fairness |
| `quota` | per-consumer allocation + fairness | interface-wire-contract | medium; best-effort, no floor |
| `reserved-capacity` | guaranteed floor + ceiling | durable-runtime-state | high; provisioned capacity |

## Schema view (the §6 entry — validated by `axis_catalog`)

```yaml
id: quota
kind: architecture-axis
scope: system-singleton
selection:
  probes:
    - "Can a single consumer's burst starve all others / the host? → at least rate-limited."
    - "Is the resource finite and shared by multiple consumers? → rate-limited."
    - "Must consumers get FAIR shares over a longer window (per-tenant/per-key)? → quota."
    - "Must a consumer have a GUARANTEED minimum capacity regardless of others? → reserved-capacity."
    - "Did an unbounded fan-out already cause a starvation incident? → it wanted a quota."
composes_with:
  - "fair sharing = quota × tenancy (per-tenant allocations)"
  - "distributed limiting = quota × distribution (a shared counter across hosts)"
applies_when: []
tiers:
  - tier: unbounded
    commitment_delta:
      surface: interface-wire-contract
      delta: "no limit; a consumer may use as much of the resource as it can. One consumer can starve all others and the host."
    admin_tool: "none — a load/usage dashboard is the only signal."
    enforcement:
      - "no admission control; every request is accepted regardless of load."
    tests:
      - "load behavior is documented (the contract is honest that there is no bound)."
    forecloses: "any fairness or availability guarantee under contention."
    migration_cost_to_next: "low — add a per-window rate limit + a 429/Retry-After contract."
  - tier: rate-limited
    commitment_delta:
      surface: interface-wire-contract
      delta: "a per-window cap (N/sec) smooths bursts; over-limit requests get 429 + Retry-After. Coarse — no per-consumer fairness."
    admin_tool: "rate-limit config; a throttled-request counter."
    enforcement:
      - "an admission check rejects over-limit requests with 429 before doing work."
    tests:
      - "a burst over the limit is throttled with 429; a within-limit stream passes; Retry-After is honored."
    forecloses: "letting any consumer exceed the global rate; per-consumer differentiation."
    migration_cost_to_next: "medium — track per-consumer accounting + a fairness policy (quota)."
  - tier: quota
    commitment_delta:
      surface: interface-wire-contract
      delta: "a per-consumer allocation over a longer window with fairness across consumers; one consumer's overuse cannot consume another's share. Best-effort — no hard floor."
    admin_tool: "per-consumer quota editor; usage-vs-quota report; fairness audit."
    enforcement:
      - "each request is charged to a consumer's quota; an over-quota consumer is rejected while others proceed."
    tests:
      - "an over-quota consumer is throttled while a within-quota consumer is unaffected; quotas reset per window."
    forecloses: "treating all consumers as one bucket; the per-consumer accounting is now load-bearing."
    migration_cost_to_next: "high — provision a guaranteed floor + ceiling per consumer (reserved-capacity)."
  - tier: reserved-capacity
    commitment_delta:
      surface: durable-runtime-state
      delta: "a guaranteed floor AND ceiling per consumer; capacity is provisioned/reserved, not merely throttled — a consumer's minimum is held even under global contention."
    admin_tool: "capacity-reservation console; utilization-vs-reservation monitor."
    enforcement:
      - "reserved capacity is held out of the shared pool; a consumer always gets at least its floor and never exceeds its ceiling."
    tests:
      - "a consumer gets its floor even when the system is saturated by others; it cannot exceed its ceiling."
    forecloses: "fully elastic sharing; reserved capacity is unavailable to others even when idle."
    migration_cost_to_next: "n/a — top of the ladder."
examples:
  - "The skill's own climb (mostly UNBOUNDED, learning the hard way): 5-wide parallel bazel agents drove loadavg to 32-72 and STARVED the daemon (UI disconnect), forcing the cap-parallel-agents-to-2-3 discipline — that is the unbounded→needs-a-quota lesson this axis names, applied to local compute fan-out. The daemon's SSE/health surface is effectively rate-limited (heartbeat cadence, connection handling). The skill's external forge calls live under the PROVIDER's rate limits (GitHub/Forgejo 429s) — a quota imposed FROM outside the system."
```

## Selection procedure (§8)

Bidirectional check for the whole system per shared resource. The escalation
pass asks "can one consumer starve the rest?" — a yes forces at least
rate-limited; a prior starvation incident forces quota. The de-escalation pass
asks "is the resource genuinely abundant?" Recorded in the system record; an
unbounded fan-out over a finite resource is a systems-analysis finding (5A.5).

## Composition (§5)

Quota is half of two **products** (derived, not authored here): fair sharing =
**quota × tenancy** (per-tenant allocations enforce isolation of *consumption*,
not just data); distributed limiting = **quota × distribution** (a multi-host
limit needs a shared counter, or each host enforces a fraction). The interaction
table derives these (5A.3).
