# A read-volume cap per caller identity.
#
# A scope authorises a read and says nothing about volume. An agent reads a
# thousand records in seconds where a person clicks ten, and the difference is
# invisible to every control the estate had until now — the token is valid, the
# tool is permitted, the ACL passes.
#
# `identifier: credential` keys the counter on what the openid-connect plugin
# published as the caller's credential, which is the `sub` claim: the end user,
# whoever is asking on their behalf. So an agent looping under one person's
# identity spends that person's budget, and cannot spend everyone's.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-payments-mcp-rate-limiting
  namespace: ${NAMESPACE}
plugin: rate-limiting-advanced
config:
  identifier: credential
  # Per-route counters. Sharing a namespace across domains would let a busy
  # domain exhaust the budget for another.
  namespace: ${NAME}-payments-mcp
  strategy: local
  sync_rate: -1
  window_type: sliding
  window_size:
    - 60
  limit:
    - ${MCP_READS_PER_MINUTE}
  # Loud rather than silent: a caller that hits the cap is told, and the headers
  # say when it resets. An agent that only sees a 429 with no Retry-After
  # retries immediately and makes it worse.
  hide_client_headers: false
  error_code: 429
  error_message: >-
    Read volume limit reached for this identity. This is a cap on how much can
    be read per minute, not a permission problem.