🚧 Roadmap — The capability described here is on the roadmap. The concepts and design are settled; interfaces and steps are subject to the final release.
Limits and SLA
This page is the quota and performance framework for GenAuth Agent Identity. All figures are authoritative only at release — load-test and capacity numbers come from engineering as a single source. Until then this page publishes no concrete values, and you should not plan capacity from numbers heard through third-party channels.
Quota and performance items
| Item | What it bounds | Baseline |
|---|---|---|
| Agents per tenant | The total number of agent identities a tenant can register — the ceiling on fleet size | TBD at release |
| Concurrent delegations per user | How many delegations one user can have active at once — keeps a single user's exposure from expanding without limit | TBD at release |
| Delegate token issuance rate | Delegate tokens issued per unit of time (per tenant) — the throughput boundary for server-side integrations | TBD at release |
| Token exchange QPS | Requests per second on the token exchange endpoint — the mandatory hop before an agent reaches a resource, usually the highest-frequency call | TBD at release |
| Audit query latency | Target latency from event to queryable — determines how real-time your alerting and tracing can be | TBD at release |
| SLA availability target | Monthly availability commitment — issuance and exchange availability is your agents' ability to act | TBD at release |
One contract boundary that is already in effect
Unlike the "TBD" rows above, the GenAuth delegation endpoint currently accepts a lifetime range of 60-86400 seconds through the SDK's expiresIn input. This is a server-side constraint, not a local range check performed by @qoniai/qoni v0.4.1. For security, pick the shortest workable lifetime — reasoning in Security considerations.
What happens when you hit a limit
At release this section will state the behaviour for each item once a limit is reached (reject with a rate-limit error, queue, or degrade) and the recommended retry strategy. Until then, integrators should default to "rate limit means rejection, retry with exponential backoff" — the most conservative assumption, and the one least likely to need rework.
Requesting a quota increase
After release this section will provide the self-service request flow and approval criteria (which items you can raise yourself and which need a capacity review).
Until then: if your scenario has a concrete capacity requirement against any row above (a large agent fleet, bulk delegation issuance), submit your expected scale and peak numbers through your support or solutions contact — that input feeds directly into the official quota figures.
Next steps
- Agent fleet governance — the governance view when you run agents at scale
- First delegation in 30 minutes — get it working first, then talk capacity
- API reference — request and error contracts per endpoint