When do you need to implement rate limiting

hey folks, i've been thinking a lot about protecting our services from abuse, accidental or intentional. rate limiting seems like a key part of that. but how do you decide when it's actually *necessary* versus just a nice-to-have? are there specific traffic patterns or API usage metrics that trigger your decision? i'm curious about your real-world experiences and the thresholds you use