A system, comprising: one or more computing devices configured to: assign a provisioned throughput capacity to a work target, indicative of a maximum rate of work operations to be performed at the work target during a normal mode of operation; receive a work request directed to the work target; in response to a determination that a token population of a normal-mode token bucket associated with the work target meets a first threshold criterion, consume one or more tokens from the normal-mode token bucket in accordance with a normal-mode token consumption policy, and accept the work request for execution; and in response to a determination that the token population of the normal-mode token bucket does not meet the first threshold criterion, determine whether a token population of at least one bucket of a burst-mode token bucket set meets a second threshold criterion; in response to a determination that the token population of the at least one bucket of the burst-mode token bucket set meets the second threshold criterion, consume one or more tokens from the at least one bucket of the burst-mode token bucket set based at least in part on a burst-mode token consumption policy, and accept the work request for execution, in response to a determination that the token population of the at least one bucket of the burst-mode token bucket set does not meet the second threshold criterion, reject the work request; refill the normal-mode token bucket at a rate based at least in part on the provisioned throughput capacity; and refill at least one bucket of the burst-mode token bucket set at another rate based at least in part on the provisioned throughput capacity. assign a provisioned throughput capacity to a work target, indicative of a maximum rate of work operations to be performed at the work target during a normal mode of operation; receive a work request directed to the work target; in response to a determination that a token population of a normal-mode token bucket associated with the work target meets a first threshold criterion, consume one or more tokens from the normal-mode token bucket in accordance with a normal-mode token consumption policy, and accept the work request for execution; and in response to a determination that the token population of the normal-mode token bucket does not meet the first threshold criterion, determine whether a token population of at least one bucket of a burst-mode token bucket set meets a second threshold criterion; in response to a determination that the token population of the at least one bucket of the burst-mode token bucket set meets the second threshold criterion, consume one or more tokens from the at least one bucket of the burst-mode token bucket set based at least in part on a burst-mode token consumption policy, and accept the work request for execution, in response to a determination that the token population of the at least one bucket of the burst-mode token bucket set does not meet the second threshold criterion, reject the work request; refill the normal-mode token bucket at a rate based at least in part on the provisioned throughput capacity; and refill at least one bucket of the burst-mode token bucket set at another rate based at least in part on the provisioned throughput capacity. determine whether a token population of at least one bucket of a burst-mode token bucket set meets a second threshold criterion; in response to a determination that the token population of the at least one bucket of the burst-mode token bucket set meets the second threshold criterion, consume one or more tokens from the at least one bucket of the burst-mode token bucket set based at least in part on a burst-mode token consumption policy, and accept the work request for execution, in response to a determination that the token population of the at least one bucket of the burst-mode token bucket set does not meet the second threshold criterion, reject the work request; refill the normal-mode token bucket at a rate based at least in part on the provisioned throughput capacity; and refill at least one bucket of the burst-mode token bucket set at another rate based at least in part on the provisioned throughput capacity.