The quota was enforced at the gateway and the caller was internal

# Self-authored for the EML case corpus (no external origin). Per-tenant quotas
# are enforced at the gateway with no bypass header and no exempt caller, and
# they refuse nine thousand four hundred requests a day. Which requests reach
# the gateway is computed below.
#
# The enforcement is genuine. There is no header a caller can set to skip it,
# no allowlist of exempt clients, and no "internal" flag in the request that
# the gateway trusts; the counter is in a shared store so it is not per
# instance; the refusal is a documented status with the tenant's remaining
# budget in it; and a load test confirms the limit holds under concurrency.
#
# The gateway is a place. Service-to-service calls inside the mesh address each
# other directly, and the nightly aggregation job calls the same API on a
# tenant's behalf without leaving the mesh.
#
# Eighteen point four million requests a day take that path.

214 => endpoints_behind_the_gateway
0 => bypass_headers_the_gateway_trusts
0 => exempt_callers
9400 => requests_refused_per_day
62000000 => requests_through_the_gateway_per_day
18400000 => internal_requests_per_day
31 => internal_services_calling_directly
0 => quota_counted_on_the_internal_path

requests_through_the_gateway_per_day + internal_requests_per_day => requests_per_day
int(internal_requests_per_day * 10000 / requests_per_day) => unmetered_per_myriad
int(requests_through_the_gateway_per_day * 10000 / requests_per_day) => metered_per_myriad

"endpoints behind the gateway    : " + str(endpoints_behind_the_gateway) ^0
"bypass headers it trusts        : " + str(bypass_headers_the_gateway_trusts) ^0
"exempt callers                  : " + str(exempt_callers) ^0
"requests refused per day        : " + str(requests_refused_per_day) ^0
"" ^0
"requests per day                : " + str(requests_per_day) ^0
"  through the gateway           : " + str(requests_through_the_gateway_per_day) ^0
"  metered                       : " + str(metered_per_myriad) + " per ten thousand" ^0
"  internal, direct              : " + str(internal_requests_per_day) ^0
"  unmetered                     : " + str(unmetered_per_myriad) + " per ten thousand" ^0
"internal services calling directly : " + str(internal_services_calling_directly) ^0
"quota counted on the internal path : " + str(quota_counted_on_the_internal_path) ^0
"" ^0

# ---- what the gateway verified ----

"the quota enforcement" ^0
"  a header that skips it : " + str(bypass_headers_the_gateway_trusts) ^0
"  exempt callers         : " + str(exempt_callers) ^0
"  an internal flag the gateway trusts : none" ^0
"  where the counter lives : a shared store, not per" ^0
"    instance" ^0
"  what a refusal returns : a documented status with the" ^0
"    remaining budget in it" ^0
"  holds under concurrency : confirmed by load test" ^0
"  requests refused per day : " + str(requests_refused_per_day) ^0
"  verdict : ENFORCED" ^0
"" ^0
"  no bypass, no exemption, and a shared counter is the" ^0
"  strong form; most quota systems fail on the third" ^0
"" ^0

# ---- what the gateway is ----

"the enforcement point" ^0
"  what it is : a place requests pass through" ^0
"  which requests pass through it : the ones addressed to" ^0
"    it" ^0
"  how services inside the mesh address each other : " ^0
"    directly, by service name" ^0
"  services doing that : " + str(internal_services_calling_directly) ^0
"  requests on that path per day : " + str(internal_requests_per_day) ^0
"  quota counted there : " + str(quota_counted_on_the_internal_path) ^0
"" ^0
"  the rule has no exceptions and the population it rules" ^0
"  over is defined by an address" ^0
"" ^0

# ---- the work is still the tenant's ----

# The nightly aggregation runs on a tenant's data, at the tenant's request, and
# consumes the resource the quota exists to protect. It is internal only in the
# sense of which network path it takes.
"the aggregation job" ^0
"  whose data it processes : a tenant's" ^0
"  why it runs : because that tenant asked for the report" ^0
"  what it consumes : the resource the quota protects" ^0
"  which quota it counts against : none" ^0
"  is it doing anything wrong : no; it calls the API the" ^0
"    way services in this mesh call each other" ^0
"  is the gateway wrong : no; it never saw the request" ^0
"" ^0

# ---- what the refusals prove ----

"the nine thousand four hundred" ^0
"  refused per day : " + str(requests_refused_per_day) ^0
"  correctly : every one" ^0
"  what they establish : the limit is real and exercised" ^0
"  what they do not establish : that a tenant's consumption" ^0
"    is bounded" ^0
"  share of requests the limit can see : " + str(metered_per_myriad) ^0
"    per ten thousand" ^0
"" ^0

# ---- null control ----

# The same quota, counted in the service rather than at the gateway, so the
# count happens where the work does regardless of which path the call took.
requests_per_day => nc_requests_metered_per_day
0 => nc_unmetered_per_myriad

"null control - the count moves to where the work happens" ^0
"  bypass headers trusted : " + str(bypass_headers_the_gateway_trusts) + ", unchanged" ^0
"  requests metered per day : " + str(nc_requests_metered_per_day) ^0
"  unmetered share : " + str(nc_unmetered_per_myriad) + " per ten thousand" ^0
"  the quota did not get stricter; it stopped being" ^0
"  attached to a doorway and started being attached to the" ^0
"  resource it protects" ^0
"" ^0

# ---- the rule ----

"what gateway enforcement guarantees" ^0
"  no request through the gateway exceeds a tenant's" ^0
"    quota : exactly, with no bypass and no exemption" ^0
"  no tenant exceeds their quota : not addressed; the" ^0
"    guarantee is scoped to a path, and consumption is a" ^0
"    property of the work" ^0
"" ^0
"a control placed at an entrance governs what enters there;" ^0
"the absence of exceptions makes it airtight over its" ^0
"population and does nothing about the size of that" ^0
"population, which is decided by routing" ^0
"" ^0

"The quota has " + str(bypass_headers_the_gateway_trusts) + " bypass headers, " + str(exempt_callers) + " exempt callers, a shared counter rather" ^0
"than a per-instance one, and it refuses " + str(requests_refused_per_day) + " requests a day correctly. It is" ^0
"enforced at the gateway, and " + str(internal_services_calling_directly) + " services call the same API directly inside" ^0
"the mesh, so " + str(internal_requests_per_day) + " of " + str(requests_per_day) + " requests a day - " + str(unmetered_per_myriad) + " per ten thousand -" ^0
"consume a tenant's resource against " + str(quota_counted_on_the_internal_path) + " counters." ^0

endpoints_behind_the_gateway = 214
bypass_headers_the_gateway_trusts = 0
exempt_callers = 0
requests_refused_per_day = 9400
requests_through_the_gateway_per_day = 62000000
internal_requests_per_day = 18400000
internal_services_calling_directly = 31
quota_counted_on_the_internal_path = 0
requests_per_day = requests_through_the_gateway_per_day + internal_requests_per_day
unmetered_per_myriad = int(internal_requests_per_day * 10000 / requests_per_day)
metered_per_myriad = int(requests_through_the_gateway_per_day * 10000 / requests_per_day)
print("endpoints behind the gateway    : " + str(endpoints_behind_the_gateway))
print("bypass headers it trusts        : " + str(bypass_headers_the_gateway_trusts))
print("exempt callers                  : " + str(exempt_callers))
print("requests refused per day        : " + str(requests_refused_per_day))
print("")
print("requests per day                : " + str(requests_per_day))
print("  through the gateway           : " + str(requests_through_the_gateway_per_day))
print("  metered                       : " + str(metered_per_myriad) + " per ten thousand")
print("  internal, direct              : " + str(internal_requests_per_day))
print("  unmetered                     : " + str(unmetered_per_myriad) + " per ten thousand")
print("internal services calling directly : " + str(internal_services_calling_directly))
print("quota counted on the internal path : " + str(quota_counted_on_the_internal_path))
print("")
print("the quota enforcement")
print("  a header that skips it : " + str(bypass_headers_the_gateway_trusts))
print("  exempt callers         : " + str(exempt_callers))
print("  an internal flag the gateway trusts : none")
print("  where the counter lives : a shared store, not per")
print("    instance")
print("  what a refusal returns : a documented status with the")
print("    remaining budget in it")
print("  holds under concurrency : confirmed by load test")
print("  requests refused per day : " + str(requests_refused_per_day))
print("  verdict : ENFORCED")
print("")
print("  no bypass, no exemption, and a shared counter is the")
print("  strong form; most quota systems fail on the third")
print("")
print("the enforcement point")
print("  what it is : a place requests pass through")
print("  which requests pass through it : the ones addressed to")
print("    it")
print("  how services inside the mesh address each other : ")
print("    directly, by service name")
print("  services doing that : " + str(internal_services_calling_directly))
print("  requests on that path per day : " + str(internal_requests_per_day))
print("  quota counted there : " + str(quota_counted_on_the_internal_path))
print("")
print("  the rule has no exceptions and the population it rules")
print("  over is defined by an address")
print("")
print("the aggregation job")
print("  whose data it processes : a tenant's")
print("  why it runs : because that tenant asked for the report")
print("  what it consumes : the resource the quota protects")
print("  which quota it counts against : none")
print("  is it doing anything wrong : no; it calls the API the")
print("    way services in this mesh call each other")
print("  is the gateway wrong : no; it never saw the request")
print("")
print("the nine thousand four hundred")
print("  refused per day : " + str(requests_refused_per_day))
print("  correctly : every one")
print("  what they establish : the limit is real and exercised")
print("  what they do not establish : that a tenant's consumption")
print("    is bounded")
print("  share of requests the limit can see : " + str(metered_per_myriad))
print("    per ten thousand")
print("")
nc_requests_metered_per_day = requests_per_day
nc_unmetered_per_myriad = 0
print("null control - the count moves to where the work happens")
print("  bypass headers trusted : " + str(bypass_headers_the_gateway_trusts) + ", unchanged")
print("  requests metered per day : " + str(nc_requests_metered_per_day))
print("  unmetered share : " + str(nc_unmetered_per_myriad) + " per ten thousand")
print("  the quota did not get stricter; it stopped being")
print("  attached to a doorway and started being attached to the")
print("  resource it protects")
print("")
print("what gateway enforcement guarantees")
print("  no request through the gateway exceeds a tenant's")
print("    quota : exactly, with no bypass and no exemption")
print("  no tenant exceeds their quota : not addressed; the")
print("    guarantee is scoped to a path, and consumption is a")
print("    property of the work")
print("")
print("a control placed at an entrance governs what enters there;")
print("the absence of exceptions makes it airtight over its")
print("population and does nothing about the size of that")
print("population, which is decided by routing")
print("")
print("The quota has " + str(bypass_headers_the_gateway_trusts) + " bypass headers, " + str(exempt_callers) + " exempt callers, a shared counter rather")
print("than a per-instance one, and it refuses " + str(requests_refused_per_day) + " requests a day correctly. It is")
print("enforced at the gateway, and " + str(internal_services_calling_directly) + " services call the same API directly inside")
print("the mesh, so " + str(internal_requests_per_day) + " of " + str(requests_per_day) + " requests a day - " + str(unmetered_per_myriad) + " per ten thousand -")
print("consume a tenant's resource against " + str(quota_counted_on_the_internal_path) + " counters.")

endpoints behind the gateway    : 214
bypass headers it trusts        : 0
exempt callers                  : 0
requests refused per day        : 9400

requests per day                : 80400000
  through the gateway           : 62000000
  metered                       : 7711 per ten thousand
  internal, direct              : 18400000
  unmetered                     : 2288 per ten thousand
internal services calling directly : 31
quota counted on the internal path : 0

the quota enforcement
  a header that skips it : 0
  exempt callers         : 0
  an internal flag the gateway trusts : none
  where the counter lives : a shared store, not per
    instance
  what a refusal returns : a documented status with the
    remaining budget in it
  holds under concurrency : confirmed by load test
  requests refused per day : 9400
  verdict : ENFORCED

  no bypass, no exemption, and a shared counter is the
  strong form; most quota systems fail on the third

the enforcement point
  what it is : a place requests pass through
  which requests pass through it : the ones addressed to
    it
  how services inside the mesh address each other : 
    directly, by service name
  services doing that : 31
  requests on that path per day : 18400000
  quota counted there : 0

  the rule has no exceptions and the population it rules
  over is defined by an address

the aggregation job
  whose data it processes : a tenant's
  why it runs : because that tenant asked for the report
  what it consumes : the resource the quota protects
  which quota it counts against : none
  is it doing anything wrong : no; it calls the API the
    way services in this mesh call each other
  is the gateway wrong : no; it never saw the request

the nine thousand four hundred
  refused per day : 9400
  correctly : every one
  what they establish : the limit is real and exercised
  what they do not establish : that a tenant's consumption
    is bounded
  share of requests the limit can see : 7711
    per ten thousand

null control - the count moves to where the work happens
  bypass headers trusted : 0, unchanged
  requests metered per day : 80400000
  unmetered share : 0 per ten thousand
  the quota did not get stricter; it stopped being
  attached to a doorway and started being attached to the
  resource it protects

what gateway enforcement guarantees
  no request through the gateway exceeds a tenant's
    quota : exactly, with no bypass and no exemption
  no tenant exceeds their quota : not addressed; the
    guarantee is scoped to a path, and consumption is a
    property of the work

a control placed at an entrance governs what enters there;
the absence of exceptions makes it airtight over its
population and does nothing about the size of that
population, which is decided by routing

The quota has 0 bypass headers, 0 exempt callers, a shared counter rather
than a per-instance one, and it refuses 9400 requests a day correctly. It is
enforced at the gateway, and 31 services call the same API directly inside
the mesh, so 18400000 of 80400000 requests a day - 2288 per ten thousand -
consume a tenant's resource against 0 counters.

Trace event types