I can imagine the investigating team meticulously tracing the root cause with the logical assumption that all rate limit polices are per-tenant, only to hilariously discover the global pool model.
This is the quality of recent engineering decisions on rate limits:
- API rate limits: new marketplace-wide DoS attack surface with bureaucratic process to exit global pool default.
- Invocation rate limits (TBD): initial plan correctly identified a global pool as problematic but then suggested a fixed rate limit regardless of tenant user size.
- License API rate limits: new minor DoS attack surface with ridiculously tiny 10 RPM rate limit shared across all apps on tenant.
What is going on?