SECAI Core · phase 7 of 15
Rate limitation
The maximum number of requests that can be made to an AI model within a given time window
The Explain card
- Plain English
- Rate limitation is the maximum number of requests a client may send to an AI model within a given time window, such as 60 calls per minute per API key.
- Example
- A public chatbot allows 30 messages per minute per session. An attacker running an automated jailbreak fuzzer that fires thousands of prompt variants gets rejected after the first 30 and has to slow to a crawl, giving the monitoring team time to spot and block the key.
- Why it matters
- Model extraction, prompt-injection fuzzing and denial-of-wallet attacks all need volume. Capping requests per window makes those attacks slow, expensive and visible.
- Hook
- A turnstile for tokens: everyone gets through, nobody gets to stampede.
Where it sits in the deck
Phase 7: AI-Specific Runtime Controls: Guardrails, Limits, and Enforcement
Responsible AI principles must be enforced mechanically — learn the runtime controls that constrain model inputs, outputs, and resource consumption.
