Tech Spec: Rate limiting and quotas

[shiphrahx]

Technical Specification

Description

Implement rate limiting and usage quotas to prevent abuse and ensure scalability.

Implementation Decisions

✅ Quotas per user:

• Teams: 20 max
• People: 100 max
• Projects: 50 max
• Tasks: 1000 max (500 open tasks max)
• Meetings: unlimited (auto-cleanup old instances)
• Meeting types: 20 max

Rate Limiting

• API calls: 100 requests per minute per user
• Database writes: 20 per minute per user

Tasks

• Implement quota checks in API
• Add quota validation in UI
• Display quota usage in settings
• Implement rate limiting middleware
• Add rate limit headers
• Handle quota exceeded errors
• Add admin override (future)
• Monitor quota usage
• Add analytics for limits

Acceptance Criteria

• Quotas are enforced at API level
• Users see clear messages when limits reached
• Rate limiting prevents abuse
• Quota usage is visible in settings

Labels: technical, security, scalability