All terms
Agent Security

Velocity Quota

Per-organization configurable rate limit that stops runaway AI agents before they flood external APIs. Token bucket implementation — containment, not throttling.


A velocity quota is a per-organization configurable rate limit that stops runaway AI agents before they flood external APIs. Unlike simple throttling, velocity quotas are designed for containment— a cap on agent tool call frequency that prevents a single misconfiguration from generating thousands of API calls per minute.

Token bucket implementation

Velocity quotas use a token bucket algorithm: each organization has a bucket of tokens that refills at a configurable rate. Every agent tool call consumes one token. When the bucket is empty, calls are rejected with a rate-limit response. This provides burst tolerance while enforcing a long-term rate ceiling.

Throttling vs containment

Throttling makes things slower. Containment stops things from breaking. A velocity quota says "this agent cannot call more than 100 Stripe API operations per minute" — full stop. The rate limit is a safety boundary, not a performance tradeoff.