A sensible rule would be 98th percentile so 98% of the time every customer can get X bandwidth. This allows for ~10 hours of downtime or congestion a month. They can still over provision, they just can't outright lie.