Skip to content

docs: document built-in tool rate limiting [PLT-2390] - #1138

Merged
iherdt merged 3 commits into
mainfrom
ilja/plt-2390-rate-limiting-docs
Aug 25, 2026
Merged

docs: document built-in tool rate limiting [PLT-2390]#1138
iherdt merged 3 commits into
mainfrom
ilja/plt-2390-rate-limiting-docs

Conversation

@iherdt

@iherdt iherdt commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

What

Adds a public docs page for the Engine's built-in tool rate limiting under Contextual Access, plus navigation and cross-links:

  • New page: app/en/operate/governance/contextual-access/rate-limiting/page.mdx
    • Rule anatomy: tool matchers (exact, Toolkit.*, *), limits, time windows (s, m, h, d, mo)
    • Enforcement semantics: fixed UTC-aligned windows, most-specific rule wins, per-tool and per-scope counters shared across users
    • What a rate-limited call sees (both the over-limit and unverified denial messages)
    • Dashboard walkthrough and API example (plugin_type: "rate_limit"), org and project scope
    • Fail-closed behavior and per-rule allow_on_unavailable
  • Sidebar entry in _meta.tsx, card on the Contextual Access index, cross-link from Build Your Own

Why

Rate limiting shipped in the Engine and the Dashboard, but there was no public documentation for configuring it. Closes the docs gap tracked in PLT-2390.

Verification

  • All factual claims checked against the Engine source (apps/engine/pkg/plugins/ratelimit/), API schemas, and route registration in ArcadeAI/monorepo
  • Vale: 0 errors
  • Full test suite passes (847 tests)

Note

Low Risk
Documentation-only changes with no runtime or API behavior modifications.

Overview
Adds public documentation for Engine-native tool rate limits under Contextual Access, covering configuration and enforcement behavior without a custom webhook.

A new Rate Limiting page explains rule matchers (exact, toolkit, global), time windows, pre-execution enforcement, UTC fixed windows, most-specific-rule wins, per-tool and org/project scoping (shared across users), agent-facing denial messages, Dashboard setup, and plugin_type: "rate_limit" via the plugins API—including fail-closed behavior when limits cannot be verified and per-rule allow_on_unavailable.

Navigation is wired through sidebar _meta, a card on the Contextual Access hub, a cross-link from Build Your Own (contrasting webhook RATE_LIMIT_EXCEEDED with built-in caps), and an entry in public/llms.txt.

Reviewed by Cursor Bugbot for commit b7a1467. Bugbot is set up for automated code reviews on this repo. Configure here.

@vercel

vercel Bot commented Aug 21, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview Aug 25, 2026 12:01am

Request Review

| `CHECK_FAILED` | Deny the operation; `error_message` is shown to the agent |
| `RATE_LIMIT_EXCEEDED` | Deny with rate-limit semantics |

For per-tool call caps that need no webhook server, Arcade also enforces [built-in rate limits](/operate/governance/contextual-access/rate-limiting).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
For per-tool call caps that need no webhook server, Arcade also enforces [built-in rate limits](/operate/governance/contextual-access/rate-limiting).
For per-tool call caps that need no webhook server, Arcade also offers [built-in rate limits](/operate/governance/contextual-access/rate-limiting).

@iherdt
iherdt merged commit 4d6e533 into main Aug 25, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants