Enforce a maximum number of requests per client per time window. Per user, per IP, per API key.

Server-enforced cap on paginated results. Client asks for 999999 — server returns max 100. Ignore the rest.

Reject uploads and request bodies above a defined size. Prevents memory exhaustion from oversized input.

Kill long-running requests after a timeout. Prevents connections from being held indefinitely by slow queries or large operations.

Restrict nesting depth and total field count in GraphQL queries. One deeply nested query can generate thousands of database calls.

Per-user quotas on expensive third-party operations: AI calls, SMS sends, video encoding. Separate limit from request rate.

Alert when consumption patterns deviate significantly from baseline. Catch scraping and abuse before the full damage is done.