Whoever Asks First

An API enforces one global limit of 10,000 requests per minute across all tenants. A single tenant's retry storm consumes the entire budget within seconds and every other tenant starts receiving 429s. What is the correct fix?

Move the limiter from the gateway into each service instance so the count is computed closer to the work being done

Give each tenant its own token bucket keyed by tenant id, so one tenant's burst can only exhaust its own allowance

Raise the global limit to 100,000 requests per minute, so a retry storm of this size no longer fills the whole budget

Return 503 instead of 429, so the misbehaving client backs off on its own and the shared budget recovers