Mental model#
Abuse control protects scarce product and infrastructure resources from actors using valid or invalid requests at harmful scale. Begin with assets, actors, attack paths, amplification, and acceptable false positives; then layer cheap controls before expensive work.
Mechanism and state flow#
- Threat model the endpoint: asset, attacker capability, identity, costly operation, and downstream blast radius.
- Reject malformed traffic and impossible requests at the earliest trusted edge.
- Apply identity-aware quotas, rate limits, authorization, payload bounds, and concurrency limits before expensive dependencies.
- Queue or shed bounded optional work and isolate critical traffic from noisy tenants.
- Measure blocked and allowed outcomes, investigate evasion, provide recovery or appeal where product policy requires it, and review defense cost.
Concrete example#
An image endpoint triggers expensive resizing
Validate dimensions and format at the edge, authorize object access, cap bytes and concurrent transforms per tenant, cache safe derivatives, and bound the worker queue. A global requests-per-second limit alone misses cost differences.
Architecture consequence: Price or limit work by the resource it consumes and isolate the transformation fleet from unrelated critical requests.
Scaling and operational trade-offs#
| Option | Choose when | Cost or limit |
|---|---|---|
| Fail closed | The protected action has financial, privacy, or irreversible impact. | Limiter or policy failure can block legitimate users. |
| Fail open with caps | Availability is critical and downstream capacity remains protected. | Attack traffic may pass during control-plane failure. |
| Challenge or progressive friction | Risk is uncertain and false positives are costly. | Adds user friction, accessibility work, and new bypass surfaces. |
Failure diagnosis#
- Failure
- The central rate-limit store becomes unavailable during an attack.
- Impact
- Fail-open overloads dependencies; fail-closed turns the limiter outage into a full product outage.
- Detection
- Limiter latency/errors rise while edge demand and downstream saturation diverge.
- Mitigation
- Use bounded local fallback, reserve capacity for critical identities, shed expensive optional work, and define endpoint-specific failure policy.
- Trade-off
- Distributed fallback is less globally precise and can allow a bounded excess.
Checklist exercise#
Work the scenario before revealing your answer
- Choose one endpoint and rank attack paths by cost amplification, data exposure, and reversibility.
- Place one cheap validation, one identity quota, one authorization check, and one capacity protection before the scarce dependency.
- State fail-open/closed behavior and a safe recovery path for false positives.
Use these prompts to extend the design. The useful answer is a reasoned change, not a memorized sentence.
- What resource is the attacker trying to exhaust or abuse?
- Which control runs before expensive parsing or storage?
- How do anonymous, authenticated, and internal callers differ?
- What happens when the defense itself is unavailable?
Related practice problems
Use the manifest-backed prompts below to apply this lesson in a complete design.
Sources reviewed 2026-09-04. Product-specific controls and threat assumptions still require current verification.