LLMs, GenAI, RAG, agents, evaluation · insight-0657
Set per-user quotas and spend limits as a security control, not only as finance hygiene
- Evidence type
- documented fact
- Difficulty
- easy
- Roles
- ML engineer, Applied AI
- Industries
- saas, e-commerce
Summary: situation, action, reason, boundary
Situation
A public or partner-facing LLM endpoint has no per-user request, token or cost limits.
Action
Enforce per-user and per-key quotas on requests and tokens, cap input size and output length, set a provider-side spend limit below the budget, and alert on unusual consumption.
Reason
OWASP classes uncontrolled inference as Unbounded Consumption and recommends input limits, rate limiting, quotas, timeouts and monitoring; provider spend limits stop requests once reached.
Boundary
Every externally reachable LLM feature, including free trials.
Symptom or risk
A script or a single abusive user drives thousands of long-context requests, exhausting rate limits for everyone and running up a large bill (denial of wallet).
Exceptions
Internal batch jobs with fixed workloads still need budget alarms, but not user quotas.
Trade-offs
Tight quotas frustrate heavy legitimate users; offer tiers.
Pitfalls
Counting requests only, while cost scales with tokens per request.
Lessons and concepts
Claims and their sources
OWASP LLM10:2025 Unbounded Consumption covers denial of service and denial of wallet, with mitigations including input size limits, rate limiting, user quotas, timeouts and monitoring.
Anthropic's API lets organisations set their own spend limit; once reached, requests are rejected until the limit is raised or the period resets.