Rate limiting lives at the edge. API gateways, load balancers. Every request checked before routing downstream. Minimizes latency, shields backend systems from traffic spikes. The cost? Limited business context. Edge only sees HTTP request data: headers, IPs, tokens. Not user history, not purchase patterns.