LLMs, GenAI, RAG, agents, evaluation · insight-1618

Treat repeated refusals and guardrail hits per account as an abuse signal

Situation
A public or partner-facing assistant enforces per-user rate limits, and abusers stay under them while probing slowly.
Action
Aggregate per account, device and network: refusal and classifier-hit counts, clusters of near-duplicate prompts, tool-error rates and token volume. Define graded friction (extra verification, lower quotas, tools off, human review, suspension), log each decision and review the top accounts weekly.
Reason
A guardrail event is evidence about intent that individual requests cannot show on their own. OWASP's unbounded-consumption guidance pairs quotas and rate limits with monitoring.
Boundary
Open sign-up products, free tiers and partner APIs.

Symptom or risk

One account sends hundreds of variations of a request that keeps hitting the safety classifier; volume stays low, so no quota ever fires.

Internal tools whose users are authenticated employees under policy.

Curious or legitimate users trigger signals; keep an appeal path and avoid permanent bans on one hit.

Counting per IP only, and telling the user exactly which phrase tripped the classifier.

OWASP's unbounded-consumption page lists input limits, rate limiting, per-user quotas, timeouts and monitoring as mitigations.
LLM10:2025 Unbounded Consumption (OWASP Top 10 for LLM Applications)