Mana bounds authenticated calls in a fixed one-minute window: 120 calls for one token and 600 for one organization. Search, reads, and writes all count.

A refused call answers 429 with a retry-after header naming the seconds to wait, and the operator log names the kind of limit that refused it. A client that respects retry-after recovers by itself.