01
Map traffic
Separate agent invocation from every downstream tool, model, and HTTP request.
Independent capacity planner · Source checked August 8, 2026
Plan the bucket from traffic, identity, and target capacity
Estimate request, token, and connection demand separately. Then choose a stable dimension that preserves user or agent attribution, includes unmatched traffic, and stays below current service quotas.
Demand estimate
Aggregate RPM
750
Inference TPM
1.5M
Connections
100
Candidate dimensions
$.context.jwt.sub, optionally combined with target or model.
Coverage
Add specific exceptions and a trailing wildcard entry so unmatched identities do not skip customer-defined enforcement.
Verification
Compare these estimates with observed percentiles, backend capacity, current service quotas, load tests, logs, and a bounded retry policy.
Planning math is not a recommended AWS rate, quota guarantee, cost forecast, security approval, deployed configuration, or Flowith integration.
Five gates
A plausible number is not a validated limit
02
Choose identity
Confirm whether each hop carries a user, IAM, OBO, or M2M agent identity.
03
Size metrics
Estimate burst requests, inference tokens, and open-connection demand independently.
04
Cover fallback
Add explicit exceptions and a wildcard entry for every unmatched bounded value.
05
Test controls
Validate quotas, fail-open behavior, Policy order, logs, throttling, and bounded retries.
Continue by implementation decision
Implementation guide
Plan metrics, bucket dimensions, layered limits, authorization, and rollout.
RPS, RPM, TPM, CPS
Match each rate metric to its target type and resource bottleneck.
OAuth and IAM dimensions
Design stable user, group, target, model, and tool buckets.
OBO vs. M2M
Trace which identity reaches downstream calls and which limits match it.
AgentCore rate-limit planner questions
It estimates aggregate RPM, inference TPM, and concurrent connection demand from user-entered planning assumptions and suggests a dimension pattern. The numbers are not AWS quotas or production recommendations.
No. It runs locally in the page and does not access AWS, create a Gateway configuration, validate identity claims, or establish a Flowith integration.
No. Service-managed quotas remain the ceiling. Effective capacity is limited by the lower applicable customer-defined limit or service quota.
No. AWS documents fail-open rate-limit evaluation. Use authentication, AgentCore Policy, AWS WAF, and downstream authorization as separate security controls.
Official references: AWS configuration guide and AgentCore Gateway rate-limit documentation. Verify current target support, APIs, Regions, quotas, dimensions, evaluation, logging, and prices before use.