Rate limits are not authorization
A
Practical lessons on auth, authorization, and access control.
Rate limits protect availability. They do not decide whether this subject may perform this action on this resource.
A caller under the limit can still be unauthorized. A caller over the limit may become allowed again once traffic cools — the authorization answer did not change.
Keep throttling and access control as separate layers, and enforce both. Do not treat “request was accepted by the limiter” as “request is authorized.”