Fixed-window limiter allows burst
You enforce a 1,000 req/min per-tenant limit using a fixed-window counter (reset at the top of each minute). A large tenant intermittently overruns and overwhelms a downstream that's provisioned for ~1,000 req/min: monitoring shows brief ~30-second windows where the downstream sees close to 2,000 req from that one tenant and saturates, even though the limiter reports the tenant never exceeded 1,000 per minute. The limiter logs confirm each one-minute window stayed at or under 1,000. How do you triage and fix the limiter so the downstream stops getting buried?
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 30 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.