Context
Provider rate limits are shared across ALL tenants (Resend limits apply per team). One tenant’s marketing blast can starve every tenant’s transactional email (OTPs, invitations).Decision
Two rails per channel:notif.{channel}.transactional (priority, seconds-latency SLO) and notif.{channel}.marketing (throughput). Marketing workers yield when transactional depth exceeds threshold. Global token bucket per provider + per-tenant fair-use bucket (Upstash). Email blasts use Resend batch endpoint (100/req) against OUR contact store; syncing contacts to Resend Audiences is FORBIDDEN. Backoff on 429; never drop. Before G1: request Resend rate-limit raise; model ceiling (10 rps × 100 = 60k emails/min theoretical; plan quotas are the real cap).
Consequences
- Tenant isolation on shared providers; transactional latency protected. − Two queues per channel to operate; worth it.