API Rate Limit and Quota Design Guide

Act as a senior backend architect designing rate limits for a public API. Create an API rate limit and quota design guide for [product/API] used by [developer audience].

API context: [REST/GraphQL/webhooks/streaming/internal API]
Traffic profile: [requests per second, burst patterns, top endpoints, tenant sizes]
Business tiers: [free, pro, enterprise, partner, internal]
Fairness goals: [protect infrastructure, prevent abuse, monetize usage, guarantee enterprise capacity]
Current stack: [language/framework, gateway, cache, database, queue, observability]
Failure tolerance: [strict enforcement vs graceful degradation]

Deliver:
1. **Rate limit policy matrix** by tier, endpoint class, authentication state, and time window
2. **Algorithm recommendation** — token bucket, leaky bucket, fixed window, sliding window, or hybrid, with tradeoffs
3. **Quota model** — monthly usage quotas, burst allowances, overage behavior, and upgrade paths
4. **Response contract** — 429 body, retry guidance, headers, idempotency notes, and SDK behavior
5. **Storage and scaling design** — cache keys, distributed counters, race conditions, and fallback mode
6. **Abuse and exception handling** — suspicious patterns, allowlists, partner overrides, and admin tooling
7. **Observability plan** — metrics, alerts, dashboards, and customer-facing usage reporting
8. **Rollout plan** — shadow mode, communication, migration timeline, and rollback steps

Include concrete examples for [2-3 critical endpoints] and call out edge cases developers commonly miss.