Test whether rate limits separate the right callers

Name the decision before opening the code

This assignment suits API owners protecting shared capacity. The brief should say which identity, tenant, route, and network signals define a quota bucket. Pin the repository revision, test environment, data constraints, reviewer, and stop condition. That keeps the investigation useful without handing production authority to the developer.

Reproduce the ordinary path once

Start with a synthetic case that should pass. Record bucket keys, counters, reset times, response headers, and denied requests. A clean baseline matters because a surprising boundary result is hard to interpret when the normal path is already unstable.

Acceptance record

Scroll sideways to read every column on a small screen.

Make the uncomfortable case explicit

Now test this case: many legitimate users share one outbound IP address. Change one input at a time. Preserve the exact request, state transition, observed result, and timestamp so a reviewer can distinguish product behavior from a fixture mistake.

Fix the smallest responsible surface

Trace the result to the narrowest code or configuration boundary that explains it. Add a regression check close to that boundary, then repeat the user-facing path. Document any nearby path you deliberately left alone.

Keep access and release decisions internal

An offshore developer can prepare fixtures, investigate, implement a bounded correction, and package the evidence. Internal owners approve sensitive access, architecture exceptions, irreversible data changes, incident communications, and production release.

Leave a handoff another shift can replay

Close with the starting and ending revisions, fixtures, commands, passed and skipped checks, logs or screenshots, limitations, rollback notes, and named reviewer. State precisely what the work showed about which identity, tenant, route, and network signals define a quota bucket.

Questions about assessing Philippine developers