Requests are counted inside fixed time intervals. Each request that arrives while the counter is below the limit is allowed; the rest are rejected. When a window ends the counter resets to zero and a fresh window begins — so a burst may be blocked just before a boundary and a new burst allowed immediately after it.