You are designing quota enforcement for a paid LLM API. A single shared account can consume 140 hours of GPU time over a week while never looking abnormal in any one-minute window. Design the limiting scheme and defend the number of limits you chose.

Explains that the abuse patterns have different durations, so no single window can catch them all, and maps each proposed window to a named pattern — burst script, deadline spike, always-on agent or shared account. Full credit needs the mapping, not just "use several limits".

Limits on tokens, GPU-seconds, or cost rather than request count, because request cost varies by orders of magnitude. Credit for noting output tokens dominate and that a limit must be checkable before the cost is incurred (estimate then reconcile).

Uses rolling windows or token buckets and explains the fixed-window boundary problem — a caller spending the full allowance at the end of one window and again at the start of the next.

Puts counters in shared storage so the limit holds across API nodes, and addresses the cost of that — atomic updates, and either local approximate counting at the edge or accepting the round trip. Credit for stating the fail-open/fail-closed decision when the store is down.

Picks the entity being limited deliberately — user, key, org, or billing account — and notices that the 140-hour case is specifically an *account sharing* problem, so a per-key limit is the wrong unit.

Returns a distinguishable signal per limit with retry-after and remaining quota, so a caller can tell which limit it hit and when to come back.

Names the downside honestly — each additional window is more state, more support load, and more user confusion — and sets the rule that a window must justify itself with a named pattern.