Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Execution Budgets, Loop Control, and Circuit Breakers
Quotas and timeouts for every tool
Verify that per-tool quotas and timeouts (e.g., CPU, memory, disk, egress, and execution time) are enforced by the runtime.
OWASP AISVS v1.01, requirement 9.1.1
In plain English
Give every tool hard limits on CPU, memory, disk, outbound traffic and run time, and have the platform enforce them. A tool that loops, or is being abused, then stops at a known ceiling. Limits written into a prompt or the tool's own code can be ignored. Limits in the runtime cannot.
What good looks like
- Each tool has written limits for CPU, memory, disk, network egress and execution time.
- The runtime enforces the limits, and neither the tool nor the agent can raise them.
- Hitting a limit ends the call, returns a clear error to the agent and is logged.
- Limits are sized from observed usage and reviewed when a tool changes.
How teams usually do it
- Run each tool in a container or serverless function with CPU and memory limits, a disk quota and a hard timeout.
- Route network-using tools through an egress proxy with destination allow-lists and data caps.
- Add per-tool call-rate limits at the tool gateway.
Suggested evidence
- Tool runtime configuration showing the limits.
- A test where a tool exceeds each kind of limit and is stopped.
- Logs of limit events from production.
Common mistakes
- Timeouts set in the agent's prompt or framework code and nowhere else.
- No egress limit, so a compromised tool can send out data freely.
- One generous limit shared by all tools, sized for the hungriest.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.