A token bucket makes burst limits explicit

Refill tokens at a steady rate up to a fixed capacity. Each request spends one token; when none remain, reject or defer it. Capacity controls the burst size, while the refill rate controls the long-run average. In a distributed service, the bucket's shared state and clock behavior need a deliberate design.