Section 13: The Ledger Balances - Final Summary & Candidate Scorecard

Executive Summary: This closing section turns the module into a scoring tool. We replay the interview arc and name the signal each phase was recording, then lay out a 100-point scorecard across six dimensions, with the exact phrases that earn and lose points on this problem. Score bands map to readiness levels, and a final catalog shows where the rate limiting question turns up in real loops under other names.

Almost every engineer can sketch a rate limiter as a counter in Redis. That shared starting point is why interviewers like the question: the score comes from how far you get from it, and whether your reasons are numbers or habits. The architecture diagram from Section 6 was worth only part of the points. The rest went to things harder to fake: whether you spotted that "about a millisecond" rules out a remote call, whether your arithmetic killed the Redis design before you drew it, and whether you kept "never the reason we're down" in mind when the allocator failed in Section 10.

The Arc, Replayed as Signal

None of the signals rewards exotic technology; token buckets, Envoy filters, pub/sub and SQL are standard parts. The points come from proportion: you measured the hot path, found the scarce resource (the 1 ms latency budget and the hottest single key, not storage), and spent your design budget there.

Key Insight: The move that separates Staff from Senior here is accepting a bounded inaccuracy. Committing out loud to "overshoot ≤ 10% over any 10 s window, false blocks under 0.1%" is what makes local decisions legal. Every later section depends on that one sentence from Section 1.

Interviewers often close with a compression test:

Interviewer: "Give me the whole design in thirty seconds."

You: "Every load balancer and sidecar decides locally in about 2 µs with a GCRA token bucket. No remote call on the hot path. Each bucket's rate is a share leased from a regional in-memory allocator, 16 shards. LBs report demand once a second, shares live 3 seconds, and quota is split by demand. So Contoso's 10,000 req/s across 40 LBs becomes 250/s each, and the extra ~4,000/s gets a 429 with Retry-After. If the allocator dies, shares stay sticky for 5 minutes and then fail open, except protective caps, which hold. Rules ship through a compiler, shadow mode and a staged rollout."

Mechanism, numbers, failure posture, in that order. A candidate who can't compress the design doesn't fully own it yet.

Quick check before moving on: