Resource Abuse

Explanation

Resource abuse checks whether the system can detect unbounded or runaway consumption — an agent, RAG pipeline or chat session that loops, over-queries, or consumes excessive compute, memory, tokens or API calls, whether through a bug, a denial-of-service attack, or a cost-exhaustion attack. In banking this matters both for service availability and for controlling the real financial cost of model and infrastructure usage. It is measured by an Unbounded consumption detection rate; the control data gives no calculation method, so implement it as the recall of a detector that identifies unbounded-consumption events (events correctly detected divided by total such events) and record the definition you adopt. To implement and operate it, instrument the pipeline with per-request and per-session quotas, rate limits, token and time budgets, loop and recursion guards, and real-time usage telemetry, and feed anomalies into a detection and alerting layer that can throttle or terminate offending sessions; log every consumption event, the limit applied, and any termination as evidence. The threshold is detection recall ≥ 0.95 with a false-negative alert, meaning the detector must catch at least 95% of genuine unbounded-consumption events; recall dropping below 0.95 — too many runaway events missed — is an immediate-priority breach that triggers an alert, tuning of the detector, and review of any incident that went undetected.