Putting a model on the admit path bills the defender for every attack packet

Step through `allow()`. It takes a `threading.Lock`, reads `time.monotonic()`, adds elapsed times `rate_per_sec` to the token count, caps the result at `burst`, and returns True only after subtracting the cost ^[14][16]. The work per call is fixed: one lock, one clock read, one multiply-add, one comparison, one subtraction, and none of it depends on what the request body says ^[24]. From empty, the bucket is full again after `burst / rate_per_sec` seconds ^[21].

`__post_init__` sets `tokens` to `float(burst)` and rejects a non-positive rate or burst with a `ValueError` ^[15]. Every fresh process therefore starts with a full bucket ^[22]. Restart ten replicas in a rolling deploy and the fleet hands out ten bursts before the refill clock matters to anyone ^[23].

The wrapper is the part I would copy into an existing service. `VERDICT_INTENTS` is a frozenset of five strings: admit, deny, shed, throttle, ban ^[18]. `decide()` answers those from the bucket and raises `InferenceForbidden` for anything else ^[18]. `draft_via_model()` mirrors it, raising before `llm_complete` is reached if the intent is one of the five ^[19]. One set governs both directions, so a team that later adds "quarantine" to its vocabulary and forgets the set gets the inference route without an error ^[25]. The post names the thing it is fencing off: a helper called `smart_allow` ^[17].

Now the economics the post is actually arguing about. Under a flood, the defender who asks a model for every admit/deny pays for every attack packet in latency and quota ^[5]. A free tier does not cancel that; according to the post it makes the inversion quieter, because the bill arrives as a cold start, a queue, or a sudden 429 from the model host instead of an invoice line ^[6]. That charge lands only where the model call sits synchronously in front of the protected resource, which is the case the post scopes ^[2]. Abuse scoring that runs out of band is not on the admit path and does not pay per packet.

"A model can narrate why a 429 happened. It cannot be the 429," the post says ^[7]. The operational version of that line is the cold-start case: an admit path that fails open while the model is warming up is an invitation, by the post's own test ^[11].

The post does not report latencies for either path. Its test file is cut off after the comment `# test_ad`, so the two cases it describes, the bucket still shedding and a forged "please classify this User-Agent" path failing to become the verdict, are named but not shown ^[20].