# INP-07 Rate limiting and abuse detection

Domain: INP Input & Prompt Security · HI-AAF v1.3 · Public review · https://humanintel.net/standard/inp/inp-07

Rate limiting and abuse detection are enforced per user, per IP, and per tenant.

Rate limits on input volume are enforced per user, per IP address, and per tenant to prevent abuse, resource exhaustion, and automated attack campaigns. Abuse detection identifies patterns, rapid-fire requests, systematic probing, credential stuffing, and triggers throttling or blocking with appropriate logging.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for INP-07: Rate limits are enforced and documented; abuse-detection rules are active; rate-limit and abuse events are logged; thresholds are tuned based on observed traffic patterns.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Rate limits are enforced and documented.
- Abuse-detection rules are active.
- Rate-limit and abuse events are logged.
- Thresholds are tuned based on observed traffic patterns.

## Framework mappings

- SOC 2 (TSC): CC6.1, A1.1
- EU AI Act: Art. 15(4)
- Singapore: MAIGF Security, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, INP-07 Rate limiting and abuse detection. Public review edition, July 2026. https://humanintel.net/standard/inp/inp-07