What is cadence governing?
A cadence governor constrains how often one account, on one host, may run: a minimum gap between runs and a cap per rolling window, plus a cooldown stamped after a run ends blocked, rate-limited or challenged. Exceeding a constraint is refused before any credit is reserved, with a retry-after and a machine-readable reason.
Why it matters
This protects the customer’s own account from the target, not the service from the customer — a distinct thing from a service rate limit. It also fails open by design: a pacing safety net that takes runs down harder than the target would have is worse than none.