Skip to main content
Policies read by the admission gate are stored fleet-wide and writable through the control API. Worker-local configuration cannot silently change shared behavior.

Tenant fairness

Work-conserving deficit service across partition_key values, including quiet groups under a flood.

Rate classes

Shared token limit, window, burst, job weight, and an operator pause switch.

Concurrency ceilings

Global in-flight limits enforced during the same admission operation.

Quarantine

Repeated crash fingerprints are parked visibly until an operator releases them.

Ordering rules

Queue weight selects which queue receives service. Job priority orders work only within a partition. Neither field overrides the other.

Explainability

GET /jobs/{id}/admission reports whether a job is admissible, which policy blocks it, and whether the condition is expected to clear. This is a first-class operational API, not a debug-only implementation detail. blocked_by: null does not mean an unknown policy. It means no admission policy is blocking the job. The job may already be running, may be pending explicit promotion, or may have reached a terminal state where admission no longer applies. Likewise, estimated_admission_ms: null means no time estimate is available; the blocking-policy name determines whether capacity can clear naturally or an operator must act.