Salesforce's identity team replaces per-server rate limits with fleet-wide quotas to hold five nines

Per-instance limits go wrong in both directions when a fleet changes size. Suppose a tenant's allowance is cut into per-server slices. Scale out without re-cutting them and the tenant's effective ceiling climbs with the server count. Scale in and it drops. Neither number is the one an operator tuned.

The other fault is that no server could see the tenant. Each Cloud Atlas server knew its own workload, never the tenant's total usage across the fleet ^[4]. "Busy servers could reject requests even while capacity remained available elsewhere," Subramani said ^[5]. She put the root cause in one sentence: "Tuning thresholds alone could not solve that because the architecture itself was protecting individual servers rather than the service as a whole" ^[7]. I think she has the diagnosis right. A per-server limit can tell whether one box is overloaded. A tenant quota has to tell whether one customer is over its share of the whole pool, and only a fleet-wide count can answer that.

"One of the biggest challenges with overload is that it does not fail politely; it amplifies," Subramani said ^[10]. In an identity tier the loop is short. Dependent services wait, requests queue, upstream systems retry, and the retries land on the store that was already slow ^[11]. A retry is a client trying to help, and under overload it is the least helpful thing a client can do. Five nines is 0.001 percent of a year, about 5.3 minutes ^[2][14]. Over a 30-day month it is about 26 seconds, so a retry storm that lasts half a minute uses up that month's allowance ^[14].

I'd expect the reason for going coordinator-free is that a central quota service in front of login becomes another tier-0 dependency. If it slows, every authentication waits on it, and the same queue-and-retry loop starts one hop earlier ^[11]. Going without a coordinator has its own cost. With no single counter, each instance acts on a picture of fleet usage that is some interval old. A tenant can overshoot its quota by whatever it sends inside that interval.

The diagnosis carries to any shared service with the properties Cloud Atlas has: many tenants on one pool ^[6], a fleet that autoscales ^[3], and callers that retry ^[11]. The design is harder to copy. The published excerpt ends before it explains how instances share usage counts or what load shedding drops first ^[8].