Execution timeouts — how long a single request can run
Maximum allocatable memory per request
Maximum number of file descriptors or processes
Maximum upload file size
Number of operations in a single client request (GraphQL batching)
Number of records returned per page in a paginated response
Rate of requests per client per time window
Requests run forever — hold connections indefinitely
One request can OOM-kill the server process
Server runs out of file handles — other requests fail
100GB uploads accepted — disk fills, service dies
One GraphQL request pulls 10,000 nested relationships
One request returns millions of records — DB and network saturated
Attacker sends 10,000 req/sec — service unavailable for real users