- Problem solved: unprotected APIs need throttling
- Must include: token bucket implementation, sliding window implementation, pluggable Spring interceptor, per-client/per-IP key strategy
- Acceptance: configurable limit correctly rejects requests over threshold in a load test
