Build a useful investigation brief
Map the counting and response path
Trace actor or credential identity, resource key, route, request admission, counter or budget decision, response creation, reset metadata, and client retry. Compare requests from separate scopes and concurrent callers. Record where policy evidence ends and avoid assuming a shared limit from similar responses.
Vary one policy dimension
Hold route and request shape fixed while varying one dimension such as actor, resource, concurrency, request count, window position, or payload size. Compare allowed, rejected, and post-reset outcomes in a controlled setting. Preserve policy inputs without exposing credentials or sensitive identifiers.
Test one safe recovery change
Evaluate one intervention such as correcting scope, exposing a clear retry boundary, exempting a necessary low-volume action, or making client backoff ownership explicit. Replay normal, limit, reset, and concurrent cases. Check fairness, duplicate actions, response contract, and eventual recovery before accepting.
What to carry forward
Deliver an evidence-backed brief with counting scope, policy dimension, reset and concurrency evidence, tested change, retry ownership, and uncertainty. Investigation is complete when implementation can target one policy boundary and verification can prove protection plus recoverable critical work.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow