when do you think its a good idea to add a rate limiter

Hey everyone, I'm trying to figure out the best triggers for putting rate limiting in place on our services. We've had a couple of recent issues where surprise traffic surges caused problems. Besides just stopping abuse, what are your usual signs or situations that make you decide it's time for rate limiting? Do you base it on certain error rates, how much resources are being used, or something different?