Three independent counters each starting at 100 can admit 300. No replica can know what the disconnected replicas spent after the partition. So write the requirement precisely: an exact global bound, with every region continuing to admit arbitrary traffic through a partition, cannot be guaranteed from local state alone. You either coordinate at the decision point, accept bounded overshoot, or pre-allocate spendable capacity and live with stranded quota. Microsoft Research's distributed rate limiting work frames coordination cost against enforcement accuracy and scale. The concrete failure policy is ours to choose.

For a hard provider limit, allocate regional token budgets whose sum is at most the global allowance for the same enforcement window. Match the provider's actual rule, whether it is a fixed window, sliding window, or token bucket. A region can spend its allocation while isolated, but cannot mint more. Before partition, a coordinator can shift allocations toward demand, with versioned grants and expiry. It must not give region B tokens that region A may still spend. Do not double-issue a returned or expired grant without accounting for its maximum overlap and clock uncertainty. If traffic becomes skewed during an outage, a busy region may reject while another holds unused tokens. That is the cost of a hard bound without cross-region communication. If a little overshoot is acceptable, keep local smoothing and reconcile, but state the maximum and test it. The provider's own 429 is still a last-line protection, not our capacity plan.

The billing or money probe changes the tolerance. A soft request throttle can sometimes trade a bounded breach for availability. A $100 credit authorization cannot casually turn into $300. Put monetary reservations through one durable authority for the economic scope, or give regions non-overlapping, unexpired escrow allocations whose total exposure stays under the cap. During a partition with no available grant, defer or deny a new action. Reconcile unknown provider outcomes before releasing a grant. The aggregate credit ledger for split agent actions is that stricter case.

Measure admission versus actual provider accepted work per tenant and region, allocation starvation, rejected useful requests, and the worst overshoot during failover and clock skew. A local limit is still good for quick protection against bursts. It is simply not a statement about global consumption unless the allocation or coordination rules make it one.