# ACT-04 Rate and cost limits

Domain: ACT Action & Tool Use Controls · HI-AAF v1.3 · Public review · https://humanintel.net/standard/act/act-04

Rate limits and cost ceilings are enforced on tool invocations per agent, per session, and per tenant.

Per-agent, per-session, and per-tenant rate limits and cost ceilings are enforced on tool invocations and customer-facing actions. The limits are tuned to expected volume and are enforced at the integration layer. Rate-limit breaches are logged and surfaced for review, preventing runaway agents from consuming resources or taking actions at a scale inconsistent with their specification.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for ACT-04: Rate and cost limits are documented and enforced for all production agents; limit breaches are logged; limits have been tuned based on observed production volume within the documented cadence.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Rate and cost limits are documented and enforced for all production agents.
- Limit breaches are logged.
- Limits have been tuned based on observed production volume within the documented cadence.

## Framework mappings

- NIST AI RMF: MANAGE 2.2
- ISO/IEC 42001: A.8.4
- OWASP LLM Top 10: LLM06
- SOC 2 (TSC): CC6.3, A1.1
- EU AI Act: Art. 15(3)
- Singapore: MAIGF Operations Management

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, ACT-04 Rate and cost limits. Public review edition, July 2026. https://humanintel.net/standard/act/act-04