The 30 second answer
The gateway, for example Spring Cloud Gateway or AWS API Gateway, validates the token, routes by path or host, and rate-limits per client or tenant. For tenant isolation I put the tenant ID in the token and give each tenant its own limit, so one noisy tenant can't starve others. Each service still checks tenant access itself, because the gateway should not be the only defense.
The gateway (Spring Cloud Gateway or AWS API Gateway) validates the token, routes by path or host, and applies rate limits per client or tenant. AWS API Gateway supports throttling and per-client usage plans with API keys. Tenant isolation: put the tenant ID in the token, rate-limit per tenant so one noisy tenant can't starve others, and still check tenant access in each service, because the gateway is not the only line of defense. Follow-up: Where do fine-grained permissions belong? (In the services; the gateway does coarse checks.) Editor's note: "check again in each service" is a defense-in-depth opinion.