Denial-of-wallet

Read these first

• Prompt injection
• Cost tracking per request, user, feature and tenant

What you will know

• Cap an agent's spend per task, per user, and per day

  A single tenant can exhaust shared quota through retries or parallel tool calls unless token usage and downstream charges are bounded separately.

• Construct an input that makes an unbounded agent expensive

  A large retrieved document, recursive self-prompt, or repeated tool result can be replayed across turns and compound both context and completion charges.

• Detect a runaway loop from a metric before the invoice

  Alert on cumulative tokens, wall-clock duration, iteration count, and estimated dollars so intervention happens while the task is still running.

• Measure cost variance across requests to show why rate limiting alone fails

  A request-per-minute ceiling still permits a small number of requests with huge contexts, expensive models, or many tool calls to consume the budget.

• Set the caps at numbers you can defend

  Choose thresholds from observed spend distributions and failure scenarios, then test that legitimate workloads fit without making abuse cheap.

Chapters

1. 1

   The per-request cost distribution

   Sixty requests per minute per user bounds a count, not a bill: one request can carry a 200,000-token context, pick an expensive model and fan out into thirty tool calls. Measured over a day of real traffic the cost of one request ran from €0.0018 at the median to €14.80 at the maximum, with sixty-two percent of the spend sitting inside the top one percent. This chapter measures that spread, names the four terms that produce it, and shows why a worst-case exposure figure has to be chosen rather than computed.

   Read chapter
2. 2

   Compounding context growth

   Uploading the biggest allowed document is one expensive call, bounded by the upload limit. The costly shape compounds: a retrieved document carrying an instruction that makes an agent re-read and re-summarise its own output, so every turn pays for everything before it and the total grows with the square of the turn count. A 40 KB file produced 121,800,000 input tokens and €365 from one request, and max_tokens does not touch it.

   Read chapter
3. 3

   In-flight budget counters

   Everything downstream of billing data is between forty minutes and three weeks behind a runaway task, which makes it a good instrument for post-mortems and useless as a control. This chapter builds the four counters a task can carry inside itself — iterations, cumulative tokens, wall clock and estimated euros — the pre-flight check that stops the breaching call being paid for, and the graded response between fine and dead.

   Read chapter
4. 4

   Budget scopes and reservations

   A per-task ceiling converts an unbounded loop into a bounded unit of purchase and then resets, which is why nine hundred correctly halted tasks can still cost 4,005 euros in one night. This chapter builds the two scopes that outlive a task — per user and per tenant — denominated in euros so tool charges are counted, and shows why check-then-act loses to forty parallel tasks and reserve-then-settle does not.

   Read chapter
5. 5

   Percentile-derived caps

   Given per-task usage at p50 8k, p99 210k and a 2.4M maximum, setting the ceiling at the observed maximum guarantees it fired zero times over the data it was fitted to and defines the control by whatever abuse and whatever bugs that month contained. This chapter replays a month of tasks against candidate ceilings, shows what a defensible cap has to name — distribution, percentile, consequence and review — and fits the number per segment rather than across a mixture.

   Read chapter
6. 6

   Gross margin per tenant

   A fourteen-seat firm on a 400-euro plan generating 3,100 euros of model spend through entirely ordinary use is the same absent ceiling as an attacker, discovered five weeks late by accident. This chapter builds the cost-against-revenue ratio that should have alerted, the four changes that took the account from 3,100 euros to 533, and the condition under which per-seat pricing stops being computable at all.

   Read chapter