Quota Before Auth

A throttle, rate-limit, or budget counter increments at request entry, before the authentication check that determines whose budget is being spent. When the bucket is keyed by route, target, or shared identity rather than by per-caller credential, unauthenticated callers debit the authenticated bucket. The 401 rejects the request; it does not refund the counter.