What is Rate Limiting?
Rate limiting is a security control that restricts the frequency of operations — transactions per minute, API calls per hour, or spending events per day — preventing abuse, automated attacks, and runaway agent behavior.
WHY IT MATTERS
Rate limiting is a blunt but effective defense. Even if an agent is compromised and every individual transaction passes policy checks, rate limiting prevents it from executing thousands of transactions in rapid succession to drain funds.
For AI agents, rate limiting serves multiple purposes: preventing runaway loops (agent stuck in a spending cycle), defending against automated attacks (compromised agent draining via rapid small transactions), and enforcing operational sanity (an agent shouldn't normally make 100 payments per minute).
Effective rate limiting is layered: per-second limits (burst control), per-minute limits (sustained rate), per-hour limits (operational bounds), and per-day limits (budget alignment). Each layer catches different attack patterns.
HOW POLICYLAYER USES THIS
PolicyLayer rate-limits agent transactions to prevent automated attacks and runaway spending. Configurable limits at multiple time windows (per-minute, per-hour, per-day) catch both burst attacks and sustained draining attempts.