LLMs, GenAI, RAG, agents, evaluation · insight-1608
Cap the volume of side effects per run and per hour in the tool layer
- Evidence type
- practitioner heuristic
- Difficulty
- medium
- Roles
- ML engineer, Applied AI
- Industries
- e-commerce, banking
Summary: situation, action, reason, boundary
Situation
An agent can refund, email or modify records, and every individual call passes its authorisation check.
Action
Put quantity and value ceilings in the tool executor per run, per user and per hour, set from the 99th percentile of legitimate use. On breach, pause and escalate rather than retry, and keep write ceilings far lower than read ceilings.
Reason
Authorisation answers whether one call is allowed, while harm accumulates across calls. OWASP lists logging and rate limiting among the measures that limit damage from excessive agency.
Boundary
Any agent with write tools, especially customer-facing ones.
Symptom or risk
A looping or hijacked agent makes hundreds of individually valid calls in minutes; no single call is wrong and the total is the incident.
Exceptions
Planned bulk operations go through an explicit batch path with its own approval.
Trade-offs
Peak days can trip a ceiling that was set from quiet weeks; review ceilings with the business owner.
Pitfalls
Counting tokens instead of actions, and per-session counters that a new session resets.
Example
Hypothetical limits for a refund tool: 5 refunds and 500 EUR per run, 40 refunds and 4,000 EUR per hour across all runs.
Lessons and concepts
Claims and their sources
OWASP lists logging and rate limiting among mitigations that limit the damage of excessive agency, alongside least privilege and human approval.