AI Security Atlas › All entries › LLM Application & Output Security
Resource Budgets, Timeouts & Graceful Degradation
Every request, session, and tenant runs within explicit token, time, and spend budgets, with a degraded mode under load.
Open in the interactive atlas →Impact
Bounds the cost and blast radius of abuse and of runaway legitimate use.
Why this severity
Guardrails take the highest severity of the risks they mitigate: No Per-Request Resource Limits (Medium), Denial of Wallet & Resource Exhaustion (Medium).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- No Per-Request Resource Limits Vulnerability · Medium severity
- Denial of Wallet & Resource Exhaustion Threat · Medium severity
Remediation
- Define budgets per request, session, user, and tenant.
- Alert on spend velocity, not only totals.
- Fall back to cheaper models or queueing when budgets tighten.
How to verify
- Chaos tests confirm degraded mode keeps core flows available.
- Budget breaches page on-call before the monthly cap.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM10:2025 Unbounded Consumption
MITRE ATLAS
NIST AI RMF 1.0
- MEASURE 2.4 AI system functionality and behavior are monitored in production
- MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate AI systems