Agentic Fabriq
Pinecone
DEVELOPER · DEVELOPER
Indexes, records, semantic search and Assistants under their own API key.
Connecting Pinecone in practice
Pinecone’s limits are structural rather than per-minute: an upsert batch is 1,000 records or 2 MB whichever comes first, a query response is capped at 4 MB however large top_k is, and fetch is throttled to 5 requests per second per namespace on top of the per-index limits. An API key can be given ProjectEditor or ProjectViewer but never ProjectOwner, ProjectManager or ProjectMember, so a key can hold data access but not project administration.
Scopes that draw scrutiny
ProjectEditorPinecone defines access by role, not scope token. Read and write access to all resources and data, with no access to project settings, members or API keys — the usual role for a writing agent.ProjectViewerRead-only access to all resources and data, which is the narrowest useful role for a retrieval-only agent.DataPlaneEditorQuery, import, fetch, add, update and delete index data, i.e. everything that can destroy an index’s contents without touching its configuration.ControlPlaneEditorRead and write access to control plane resources, so it can create and delete indexes rather than records.ProjectOwnerFull access including members and API keys. Pinecone explicitly forbids assigning it to an API key, so it belongs to people and service accounts only.
Rate limits
- Query: 2,000 requests per second, enforced per index in addition to read-unit limits.
- Fetch: 100 requests per second per index, and 5 requests per second per namespace.
- List: 200 requests per second.
- Monthly usage: Starter 1M read and 2M write units, Builder 2M and 5M, Standard and Enterprise unlimited.
- Operation caps: upsert 1,000 records or 2 MB per request (96 records when upserting text), 40 KB of filterable metadata per document, top_k up to 10,000, 4 MB query response ceiling, 1,000 record IDs per fetch or delete, 10,000 values per $in or $nin.
Worth knowing
- A request fails if it exceeds any applicable limit, so the per-namespace figure can reject a call that is comfortably inside the per-index budget.
- Usable batch size shrinks with dimension and metadata: 1,000 records at 386 dimensions with no metadata, but 245 at 1,536 dimensions with 2,000 bytes of metadata.
- The gRPC SDK gets write-throttled sooner than the REST path, and Pinecone’s own advice is to implement retries with exponential backoff rather than to slow the SDK down.
- When a query approaches the 4 MB response ceiling the documented fix is include_metadata=False or include_values=False, so a large top_k forces a second round trip to get the payloads.
Checked against Rate limits (2026-09-29), Operation limits (2026-09-29), Understanding projects (2026-09-29), Upsert data (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Pinecone behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.