Overview
Authenticated rate limits use a server-side reputation layer. It scores users, sessions, API keys and network origins from auditable signals, then returns a coarse risk tier and a rate-limit multiplier to the API and database guards. Trusted, organic use gets more headroom; suspicious automation gets less.- The policy runs only on the server. Scoring rules and reason codes are never sent to clients or shown in responses.
- Request-shape signals can raise caution; they cannot earn trust on their own.
- Sensitive actions can require a fresh step-up verification tied to the same session.
- People who are rate limited can appeal, and operators can investigate with audit records.