Demand Admission Gate¶

An admission-control protocol — instantiates Sustainable Load Envelope Governance

Decides at the point of entry whether each new unit of demand is admitted, queued, redirected, or staged — so the envelope is protected by controlling what gets in, before load is ever taken on.

The cheapest place to protect an envelope is at the door, before demand becomes load the system is committed to carrying. Demand Admission Gate is that door. It evaluates each incoming unit of demand against the envelope's remaining headroom and decides its fate — admit, queue, redirect, or stage — refusing or slowing intake when accepting would eat into the protected margin. Its defining move is that it acts on new demand before it is taken on: it governs intake, shaping what the system agrees to carry, rather than clawing back load already inside. That preventive, boundary-sited stance is exactly what separates it from load shedding, which removes work the system has already committed to.

Example¶

A SaaS platform runs against a reliability budget — the sustainable rate of requests it can serve without accelerating error-budget burn and the on-call toil that lowers future reliability. A large new tenant wants to onboard. Rather than accept the traffic and hope, the admission gate stages the ramp: 10% of the tenant's load, then 40%, watching headroom at each step; it queues non-urgent onboarding for quieter windows and redirects overflow to a lower-tier path. Admission is decided against remaining headroom, not against raw peak capacity, so a normal midday spike does not tip the system into breach. The effect is that "we are full for sustainable purposes" becomes an explicit, reversible decision at the boundary instead of a silent degradation that shows up later as burned reliability.

How it works¶

For each arriving request, commitment, or tenant, the gate asks whether admitting it would leave enough headroom, and if not, which lever to pull — hard refuse, queue, redirect, or stage a gradual ramp. It enforces the admission-and-quota rule at the system boundary and reads the remaining margin to decide. What makes it this mechanism is that it is preventive and sited at intake: the substrate is protected by never overcommitting in the first place, so the envelope is defended before any load is taken on rather than after damage begins.

Tuning parameters¶

Admission threshold — how much headroom must remain before the gate stops admitting freely. A conservative trigger protects the substrate but refuses more borderline-useful demand.
Response menu — which levers are permitted: hard refuse, queue, redirect, or staged ramp. More options soften the gate but complicate it and can obscure the true limit.
Priority and class rules — which demand classes are admitted first under pressure. This sets whose demand waits, a fairness and mission choice, not a purely technical one.
Reservation versus first-come — whether headroom is pre-allocated to priority uses or simply admitted as demand arrives.
Hysteresis — how far conditions must recover before the gate reopens, so it does not flap open and shut at the threshold.

When it helps, and when it misleads¶

Its strength is preventing overcommitment at the cheapest possible point — before load is taken on — and turning "we are at our sustainable limit" into a deliberate, visible decision rather than a slow, unremarked erosion of the substrate. It generalizes admission control, the entry-point discipline used in queueing systems, networks, and hospital emergency departments, from protecting instantaneous service to protecting a renewing substrate.^[1]

Its honest limits are two. First, a gate displaces demand rather than destroying it: refused load goes to a queue, a competitor, or a later moment — the burden moves, it does not vanish — so a gate with no relief valve just relocates the problem. Second, the classic misuse is tuning the admission threshold to hit a throughput or utilization target instead of to protect the envelope, which quietly converts the safety margin into routine load. The discipline that guards against both is to tie the trigger to substrate headroom rather than to a throughput KPI, and to pair the gate with a recovery or expansion path so that persistent refusals are read as a signal to grow capacity, not as a permanent wall.

How it implements the components¶

admission_and_quota_rule — it is the operative rule at the boundary: the logic that admits, caps, queues, redirects, or stages each unit of new demand.
safety_margin_or_headroom — it triggers on remaining headroom and acts to keep the operating point inside the protected margin rather than pressed against the envelope edge.

It does not derive the envelope or set the quota and ceiling levels it enforces — Carrying Capacity Assessment derives the envelope, while sustainable yield quota and utilization ceiling and headroom rule set the numbers — and it does not reduce load already admitted, which is the job of Load Shedding Trigger.

Instantiates: Sustainable Load Envelope Governance — it is the intake control that keeps demand from overcommitting the envelope in the first place.
Consumes: Carrying Capacity Assessment supplies the envelope, and Utilization Ceiling and Headroom Rule sets the headroom level the gate defends.
Sibling mechanisms: Load Shedding Trigger · Utilization Ceiling and Headroom Rule · Sustainable Yield Quota · Carrying Capacity Assessment · Safe Operating Envelope Chart · Substrate Depletion Dashboard · Ecosystem or Asset Monitoring Transect · Capacity Drawdown Ledger · Capacity Envelope Review Board · Recovery Window or Rest Period · Regenerative Budget

References¶

[1] Admission control — the standard practice, in queueing systems, networks, and hospital emergency departments, of deciding at the entry point whether to accept new work so that accepting it will not degrade service for those already inside. The envelope version generalizes the protected target from instantaneous service to the renewing substrate. ↩