One doc tagged with "rate limits"

What is the approach to API Authorisation to validate access is segregated to minimum scope and limited to least privileged access?