Throttling Gates: Access and Congestion Control

• Throttling gates are control mechanisms that restrict resource access by enforcing computational challenges or thresholds to balance demand and consumption before system destabilization.
• They are applied in diverse areas including AI web agents, data-center congestion control, smart home gateways, and transportation systems, ensuring efficient load management and fair resource allocation.
• Key design principles include computational asymmetry, scalability, and robustness to adversaries, enabling tailored gating strategies for varied operational contexts.

Throttling gates are control mechanisms that regulate access to scarce resources by constraining admission, rate, timing, or action execution. In the literature, the term appears explicitly as a challenge-based access-control framework for AI web agents, and more broadly as a family of gated admission, injection-throttling, grant-based polling, ramp metering, weighted scheduling, and graph-process formulations across communication networks, transportation systems, queueing models, intrusion detection, and tool-using LLM agents (Kumar et al., 1 Sep 2025). The common role is to place an operational boundary between attempted demand and actual resource consumption, so that congestion, overload, policy violation, or propagation cost is controlled before the underlying system is destabilized.

1. Formal concept and core properties

A direct formalization treats a throttling gate as the point where a service provider $\mathcal{S}$ asks an agent $\mathcal{A}$ to solve a set of puzzles before granting access to a resource $\rho$. In that framework, a bank of pre-generated challenge-solution pairs is constructed offline as

$$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$

and online access is decided by

$$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$

where $T_{num}$ is the maximum number of challenges per session and $T_{min}$ is the minimum number of correct responses required to pass (Kumar et al., 1 Sep 2025).

The same work specifies four core properties for an effective throttling gate. Under Computational Asymmetry, generation should be cheap, verification should be constant-time, and solving should be expensive. Under Scalability, the mechanism should support billions of problems with low operational overhead. Under Robustness to Adversaries, it should resist shortcuts and avoid introducing new server attacks. Under Compatibility, it should permit adjustable complexity and support low-resource, text-only agents. These properties supply a general design vocabulary for throttling mechanisms even when the gate is not puzzle-based.

A plausible common abstraction is an admission boundary whose decision rule depends on some combination of proposed action, current state, and policy parameters. In some systems the boundary is explicit and synchronous, as in challenge-response or pre-execution verification; in others it is embedded into scheduling, polling, or queue-management logic. What varies across domains is not the existence of the gate, but the object being throttled: packets, flows, vehicles, customers, alerts, tool calls, or graph-process resources.

2. Congestion control and packet-level gating in communication systems

In data-center and supercomputer interconnects, injection throttling is a closed-loop congestion-control mechanism. DCQCN organizes the loop around a Congestion Point (CP) at the switch, a Notification Point (NP) at the destination, and a Reaction Point (RP) at the source. The reported limitation is that DCQCN cannot distinguish between congesting flows and victim flows, so marked packets trigger throttling even when they do not contribute to queue buildup. In the threshold model, packets are marked if switch queue occupancy exceeds a threshold,

$\text{Mark}(P) = (Q > V),$

where $V$ is the buffer threshold. The revised mechanism, DCQCN-Rev, replaces this with Enhanced Congestion Point (ECP), Enhanced Notification Point (ENP), and Enhanced Reaction Point (ERP), so that marking becomes contributor-specific,

$$\text{Mark}(P) = \text{IsContributor}(P) \ \text{and} \ Q > V,$$

notifications are sent only to sources actually responsible for congestion, and source-side throttling is flow-specific (Olmedilla et al., 7 Nov 2025).

The reported evaluation uses a 64-node, 3-stage CLOS with 100 Gbps links and 64MB shared switch buffers. Four flows generate incast to one node, while one victim flow traverses the congested region without contributing to congestion. With PFC, overall throughput is only 15 GB/s and the victim flow is crippled by HoL blocking. With standard DCQCN, all flows, including the victim, are throttled due to indiscriminate packet marking. With DCQCN-Rev, the victim flow $\mathcal{A}$0 achieves line rate, 12.5 GB/s; congesting flows share bandwidth fairly; and all flows are delivered in 4ms, compared to $\mathcal{A}$1ms with PFC and $\mathcal{A}$2ms with legacy DCQCN (Olmedilla et al., 7 Nov 2025).

In hybrid PON/xDSL access networks, throttling is implemented through polling-based gating rather than feedback marking. The OLT sends a GATE message to each ONU specifying the size of its upstream transmission window on the PON, and then per-CPE GATE messages specifying how much data and when each CPE may transmit upstream on the DSL segment. The grant size $\mathcal{A}$3 bounds the maximum data arrival to the drop-point within a polling cycle, and the timing analysis yields the earliest CPE transmission start

$\mathcal{A}$4

and the maximum per-CPE drop-point buffer occupancy

$\mathcal{A}$5

The result is a proactive mechanism that guarantees a calculable occupancy bound and remains effective under very bursty traffic, in contrast to PAUSE-frame flow control (Mercian et al., 2015).

3. Edge shaping, bandwidth plans, and audited throttling regimes

At the broadband edge, throttling gates often appear as threshold-rate policies coupled to fairness or utility objectives. One decentralized design uses smart home gateways in a two-level hierarchy. At the first level, gateways purchase guaranteed bandwidth from the ISP with virtual credits, subject to the update rule

$\mathcal{A}$6

with budget caps to prevent hoarding. At the second level, the gateway allocates the purchased bandwidth among apps and devices according to user-specified priorities by solving

$\mathcal{A}$7

In simulations with 16 gateways sharing a single link for one week, aggregate user satisfaction increased by about 30% over equal sharing, Jain's fairness index for cumulative rates converged to 1, and the online algorithm recovered $\mathcal{A}$8 of the optimal utility (Wong et al., 2013).

A complementary formulation studies ISP data plans with a threshold $\mathcal{A}$9 and a throttled rate $\rho$0. Up to $\rho$1, a user can transmit at the unthrottled rate $\rho$2; after $\rho$3, the rate drops to $\rho$4 for the rest of the billing cycle. The capacity constraint is written as

$\rho$5

and user dissatisfaction is modeled by regret,

$\rho$6

This yields tractable optimization problems for streamers and downloaders, and extends to a game-theoretic setting in which users choose among plans with different $\rho$7 pairs and the game converges (Bayat et al., 2022).

At the home gateway, CAKE realizes a throttling gate by shaping traffic slightly below the physical bottleneck so that queues build only where the router can manage them. It uses a virtual transmission clock: if $\rho$8, the scheduler waits, and then updates

$\rho$9

With overhead compensation, ATM framing is modeled as

$$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$0

The system integrates bandwidth shaping, DiffServ handling, per-flow and per-host fairness, and ACK filtering so that the gate is precise enough to suppress downstream bufferbloat while remaining work-conserving across tiers (Høiland-Jørgensen et al., 2018).

Auditing literature treats throttling gates as observable policy regimes. A policy-aware cross-layer study of Starlink aligns portal-labeled traces, terminal telemetry, and host-side probes, and uses the internal-to-user ratio

$$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$1

to separate high-speed from low-rate operation. Using 180s windows, the rule labels a window “high-speed” only if throughput exceeds $$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$2 Mbps and $$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$3. Reported medians are $$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$4 Mbps for stay-active, $$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$5 Mbps for post-quota throttling, and $$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$6 Mbps for high-speed operation, with no errors in separating high-speed from low-rate windows on that deployment (Wang et al., 9 Mar 2026).

4. Ramp metering, perimeter control, and queue admission

In transportation systems, throttling gates appear as controlled entry points that prevent capacity loss or excessive accumulation. For a controlled motorway, ramp metering is formulated by proportional fairness. The metering rates $$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$7 solve

$$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$8

with optimal rates of the form

$$C_b = \mathcal{G}([d_1,\dots,d_m],[w_1,\dots,w_m]),$$9

where the dual variables $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$0 act as shadow prices for bottleneck resources. In the heavy-traffic Brownian approximation, stationary delays satisfy

$$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$1

This directly links motorway entry throttling to Internet-style rate control and fairness (Kelly et al., 2010).

For monocentric cities, multi-gated perimeter control augments the protected network state with queue states at origin links. The dynamics are

$$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$2

with bounds on $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$3, $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$4, and $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$5. After linearization and discretization, the control problem becomes a convex finite-horizon QP,

$$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$6

embedded in a rolling-horizon MPC. In a 2.5 square mile protected network area of San Francisco with fifteen gates, total time spent by vehicles in entrance queues is reported as up to 4x lower with multi-gated control than with CAP or OAP (Jusoh et al., 2024).

Queueing theory supplies an even more reduced model. In an unobservable M/M/1 queue, Random Routing (RR) admits each arrival independently with probability $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$7, whereas Gated Admission (GA) blocks arrivals for a fixed period $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$8 after each admission. The admitted process then has inter-arrival times $$\text{Access Permission} = \mathcal{T}(C_b,\ell,T_{num},T_{min}),$$9 and effective throughput

$T_{num}$0

At equal effective admission rates, GA stochastically dominates RR and yields strictly higher welfare for any sojourn-based cost. The welfare gap is summarized by the Price of Forgetting,

$T_{num}$1

which is unbounded even though the absolute welfare gain stays uniformly bounded (Hassin et al., 1 Jun 2026).

5. Security, agentic enforcement, and reversible mitigation

Security applications use throttling gates to suppress overload without discarding the information needed for diagnosis. In intrusion detection, one approach combines a token bucket filter with real-time attack-graph correlation. Each alert consumes a token from a bucket with rate $T_{num}$2 and capacity $T_{num}$3; over-limit alerts are dropped or run-length encoded, but queues corresponding to attack-graph exploit vertices preserve alerts crucial to forming strategies. In an ICMP flood of over 7,000 packets/second, token bucket filtering at 2 alerts/sec with burst 20 reduced logged data from 475MB to $T_{num}$4MB and alert count from 300,000+ to $T_{num}$5 while retaining correlated attack strategies (0801.4119).

For encrypted traffic at consumer gateways, NOS-Gate instantiates a per-flow, two-state dynamical unit over 250 ms windows of metadata. Its actionable decision uses a $T_{num}$6-of-$T_{num}$7 persistence rule,

$T_{num}$8

with defaults $T_{num}$9 and $T_{min}$0, and then applies a reversible mitigation by reducing the flow’s WFQ weight from $T_{min}$1 to $T_{min}$2. At an achieved $T_{min}$3 false-positive operating point, incident recall is reported as $T_{min}$4 versus $T_{min}$5 for the best baseline in those runs; gating reduces p99.9 queueing delay and p99.9 collateral delay; and the mean scoring cost is $T_{min}$6 per flow-window on CPU (Bilal et al., 1 Jan 2026).

In tool-using LLM agents, deterministic pre-execution read-only gates inspect a proposed write tool call and the current state before allowing mutation. A single gate is a pure predicate

$T_{min}$7

The reported four-gate suite—covering cancellation eligibility, baggage allowance, passenger count, and must-read-before-write—raises full-benchmark success from $T_{min}$8 to $T_{min}$9 on gpt-4o-mini, with gains concentrated on the 26/50 firing tasks; two negative controls show that gates add little where tools already self-enforce policy. The paper’s central claim is bounded: deterministic gates do not guarantee task success, but they can deterministically prevent a known class of silent policy-violating writes at the action boundary (Reddy et al., 8 Jul 2026).

AI web-agent throttling uses challenge asymmetry instead of state predicates. Rebus-based reasoning gates are designed to impose token-generation costs on agents before access to web resources or MCP services. Existing coding or math puzzles are reported not to satisfy the full property set, whereas the rebus-based framework achieves computational asymmetry up to $\text{Mark}(P) = (Q > V),$0 for reasoning models and up to $\text{Mark}(P) = (Q > V),$1 for non-reasoning models, with an average of $\text{Mark}(P) = (Q > V),$2. The mechanism therefore throttles by making solving expensive while keeping generation and verification cheap (Kumar et al., 1 Sep 2025).

6. Graph-theoretic throttling as a resource-time optimization problem

In graph theory, throttling denotes a resource-time trade-off rather than an online admission controller. For a graph process with propagation time $\text{Mark}(P) = (Q > V),$3, the sum throttling number is

$\text{Mark}(P) = (Q > V),$4

and product throttling is defined analogously using $\text{Mark}(P) = (Q > V),$5 or $\text{Mark}(P) = (Q > V),$6. Recent work studies sharp Nordhaus-Gaddum bounds for standard zero forcing, positive semidefinite forcing, power domination, and Cops and Robbers. Representative results include

$\text{Mark}(P) = (Q > V),$7

for standard zero forcing sum throttling, and

$\text{Mark}(P) = (Q > V),$8

as a lower bound for product throttling (Blair et al., 29 Jun 2026).

For skew zero forcing, the skew throttling number of a set $\text{Mark}(P) = (Q > V),$9 is

$V$0

The literature characterizes graphs with skew throttling numbers $V$1, $V$2, $V$3, and $V$4, and derives exact values for paths and cycles: $V$5 It also gives a sharp lower bound in terms of diameter,

$V$6

for connected graphs of diameter $V$7 and minimum degree at least $V$8 (Curl et al., 2019).

This branch of the literature is conceptually adjacent to operational throttling gates because it formalizes the same basic trade-off between initial resources and completion time. The difference is that the object being throttled is not ingress into a live system, but the combinatorial budget needed to complete a graph process efficiently.