When building middleware with capacity limits, the design should follow three principles: the limit is visible, loss is detectable, and rejection is better than silence.