rate_budget

Sliding-window request limiter for agent tool calls.

What it mitigates

Runaway loops and rapid retries
Cost spikes from uncontrolled call volume
Resource pressure during degraded states

Recommended defaults

Profile	windowSec	maxCallsPerWindow
`local`	`60`	`30`
`standard`	`60`	`60`
`unbounded`	`60`	`120`

Minimal config

moduleConfig:
  rate_budget:
    windowSec: 60
    maxCallsPerWindow: 60

Tuning strategy

Increase limits only after measuring normal workload.
Keep stricter caps for high-risk tools.
Re-run pentest flood scenarios after each change.