Implement request rate limits

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R03 — API resource limits

   R25 — Docker resource & process boundaries

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Implement per-user request rate limits, concurrency limits, and maximum tool-call budgets per turn.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Simulate a recursive tool-calling loop and a provider retry storm; verify deterministic stop conditions halt execution.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Rate/concurrency limiter tests and loop-termination load observations.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsDocker
  Docker Engine security | Docker Docs

  Covers the daemon socket as a root-equivalent surface, namespaces/capabilities, and non-root or rootless operation, which is the containment boundary for a tool-executing app.

  R25S3checked 2026-11-11
• videoByteByteGo · 7:46
  Rate Limiter System Design: Token Bucket, Leaky Bucket, Scaling

  Compares token bucket against leaky bucket and fixed window, which determines whether your per-user limit allows a burst or enforces a smooth rate.

  R03M5checked 2026-11-11
• videoTechWorld with Nana · 18:27
  Top 8 Docker Best Practices for using Docker in Production

  Shows non-root users, minimal base images, read-only filesystems, and secret handling, which are the concrete settings that stop a compromised tool from escalating to the host.

  R25checked 2026-11-11
• articlesmudge.ai
  Visualizing algorithms for rate limiting

  Animated comparisons of token bucket, leaky bucket, fixed and sliding windows, making the burst-versus-smoothness tradeoff visible before you pick a limiter for per-user concurrency and tool-call budgets.

  M5R03checked 2026-11-11
• repoGitHub
  laurentS/slowapi: A rate limiter for Starlette and FastAPI

  Decorator-based limits keyed by user, route, or custom function, which is the direct implementation path for per-user request limits in a FastAPI app.

  R03M5checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.