when dont we see rate limiting being used?

Hey everyone, I'm trying to figure out the best time to put rate limiting into our systems. Traffic's been going up, and we're seeing some random abuse, but it's not a disaster... yet. What makes you decide it's time to add rate limiting? Do you just look at how much traffic there is, certain errors, or is it more complicated? I'm really interested in hearing what you all do.