Interview question
How would you control unbounded consumption and denial-of-wallet attacks in an AI system?
Bounds expensive inputs, outputs, retrieval, tools, retries, concurrency, and fan-out while preserving fair service.
TL;DR
I limit request size, files, context, output tokens, tool calls, retries, agent turns, fan-out, concurrency, and elapsed time per user, tenant, and workload. Admission control reserves capacity for important traffic and rejects or queues work before expensive execution. Every run has a budget the model cannot increase.
Resource abuse, denial of wallet, budgets, rate limiting, admission control, and graceful degradation.
Core answer first, then checkpoints toward a stronger answer.
Start here. This is the direct spoken answer to practice first.
AI cost and capacity can be attacked through more dimensions than request count alone.
I limit request size, files, context, output tokens, tool calls, retries, agent turns, fan-out, concurrency, and elapsed time per user, tenant, and workload. Admission control reserves capacity for important traffic and rejects or queues work before expensive execution. Every run has a budget the model cannot increase.
Optional upgrade with examples, trade-offs, and sharper phrasing.
Rate limits use cost-weighted units rather than treating a short classification and a long multimodal agent run as equal. Caching, batching, smaller models, and asynchronous work reduce legitimate cost but do not replace abuse controls. The system detects recursive tool loops, decompression bombs, huge retrieval results, slow streams, repeated cache misses, and coordinated account activity.
Optional deeper angle for production judgment and nuance.
Budgets roll up from operation to user, tenant, provider deployment, and organization with alerts and automatic circuit breakers. Degraded modes can shorten output, disable optional tools, use a cheaper validated model, or serve a deterministic alternative without crossing safety boundaries. Security tests include distributed low-rate abuse and expensive valid-looking prompts. Post-incident analysis separates malicious consumption, product bugs, provider changes, and organic demand so controls do not punish legitimate growth.
Use these to catch weak phrasing, shallow reasoning, and risky claims.
Quick interviewer prompts inside this drill.
Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.
Next in AI Security, Privacy & Governance: Privacy-safe AI audit