Capacity gating is the practice of limiting access to a service when demand, compute, or operational limits are reached. Instead of letting every request through, the system slows, queues, rejects, or tiers access based on available resources. This is common in cloud platforms, APIs, AI services, and other shared infrastructure where overload can quickly reduce reliability for everyone.
In cyber security, capacity gating matters because availability is part of defense. Well-designed gating can prevent resource exhaustion, protect critical users, and keep systems stable during spikes or abuse. Defenders use rate limits, admission control, priority queues, and degraded modes to preserve core functions. Attackers may try to defeat or trigger gating through denial-of-service traffic, account flooding, or repeated retries that consume limited capacity. Strong gating helps a service fail safely, rather than collapsing under pressure or exposing inconsistent behavior that attackers can exploit.