Rate Limiting Citizen-Facing AI Services

The launch link went on a social channel at 10:02. By 10:18 the hosted meter had blown the month. By 10:25 the desk was serving cached nonsense because someone had 'failed open'. The flood was not sophisticated. It was a share button and a missing cap.

Rate limiting a citizen-facing agent is availability, cost, and security in one control. A flood is a denial of service to the citizen who actually needs the desk. It is a denial of wallet if you are on a meter. It is a brute-force path against retrieval ACLs if you let anonymous clients try names all day.

This guide is for CISOs and CIOs on 17 August 2026. Not legal advice. It pairs with the denial-of-wallet explainer. Here we design the brakes. There we price the crash.

Prcept will not ship a public desk that fails open. If your integrator thinks 429 is unfriendly, they have not sat a launch morning.

Four dials, not one WAF rule

Identity. Authenticated citizens get a per-principal quota that matches the unit — a handful of questions per case, not an infinite salon. Anonymous FAQ gets a tighter per-session quota.

Network. Per-IP and per-prefix limits catch the share-button flood. They are unfair to NAT-heavy campuses, so they are a backstop, not the only dial.

Verb. Retrieval of personal collections is expensive and sensitive; it gets a smaller cap than public circular search. Write verbs, if any exist, get a tiny cap and a human.

Spend or GPU. A rupee or hour ceiling with an owner and an SMS at 70 percent. Fail closed: the desk goes dark or degrades to static search, it does not silently mint debt.

Starting dials for a public FAQ plus an authenticated status desk. Tune with measurement, not with hope.

Path	Start cap	Fail mode
Anonymous FAQ	10 questions / 10 min / IP; 30 / day / session	Static page, not fail open
Authenticated status	20 / hour / principal	Queue a human, do not widen ACL
Retrieval of personal class	5 / hour / principal	Deny, log
Any write verb	1 / hour and human gate	Off
Monthly meter	Hard rupee or GPU hours; SMS at 70%	Degrade to search

Where the limit must live

Enforcement is on the server you control, in front of the planner and in front of the meter. A front-end disable of the send button is etiquette. Attackers do not use your button.

Do not rely only on the model host's default. Their default is about their estate, not your launch, and it may fail open into overage. Read the contract. Put your own brake first.

Return honest 429s with a retry-after. Silent drops create retries, which create a worse flood. Tell the citizen the desk is busy. Offer the static page and the helpline.

Fairness and language

Do not punish a whole university NAT for one noisy hostel. Combine identity and network dials. Allowlist known campus egress if you must, with their own cap.

Voice and Indic languages can use more tokens per question. Cap questions, not only tokens, or you will silently punish the citizens you claimed to include.

Accessibility tools can look like bots. Work with the GIGW owner so a screen reader is not your first false positive. Rate limits that lock out the people the desk was built for are a different kind of incident.

• Server-side, fail closed.
• Identity + network + verb + spend.
• Degrade to a certified static page.
• SMS the owner at 70 percent.
• Red-team the cap before DNS.

When the flood is an incident

A volumetric attack on a government application can be a listed cyber incident. A share-button surge may be operations. Do not invent an AI type. Map the effect. Keep the six-hour owner in the loop if the SOC says it has crossed into an attack on the application or a denial of service as the annexure uses those ideas.

Logs of 429s and of spend-cap trips belong in the 180-day store. They are how you later prove the brake worked, or that it did not exist.

If the flood caused a fail-open that leaked or wrote, you no longer have a capacity story. You have the other articles in this cluster.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Limits will make us look down.

A dark, honest page looks better than a blown meter or a leak. Publish the static FAQ as the dignified degrade.

The cloud WAF is enough.

WAFs help with obvious floods. They do not know your rupee ceiling or your personal-retrieval verb. Keep your own dials.

We cannot estimate traffic.

Then launch with a tight cap and a human queue, or launch to a district first. Guessing infinite is how 10:18 happens.

Officers should be unlimited.

Officers get a higher cap, not an infinite one. Compromised officer sessions are a thing. Insiders are a thing. Infinity is not a role.

A ten-day brake install

Install brakes before DNS. Test them until they hurt.

1. Day 1: choose the four starting dials. Write fail closed.
2. Day 2–3: implement server-side. Kill front-end-only limits as the main control.
3. Day 4: spend or GPU ceiling with SMS at 70 percent.
4. Day 5–6: flood test from more than one prefix. Confirm degrade to static.
5. Day 7: campus NAT and language fairness check.
6. Day 8–9: 429 logging into the 180-day store.
7. Day 10: CISO and finance initial the dials. DNS only after.

How this shows up in the file

Subject: Rate limits — public agent [name].

Dials: [identity, network, verb, spend]. Enforcement: server-side at [component]. Fail closed to [static page / human queue]. SMS owner: [post] at 70 percent of [rupees or hours]. Officers are capped at [n]. NAT exceptions: [list]. Flood test dated [date]. CERT-In mapping for volumetric attacks uses existing types. Not legal advice.

Front-end button disable is not listed as a control.

Result day is not infinity

Exam-result hours and scheme-launch hours will blow a quiet-month estimate. That is not a reason to remove the cap. Pre-raise it with a dated exception, extra static capacity, and a named owner. When the hour ends, the raise ends.

Count questions, not only tokens. Indic and voice turns are longer. A token-only cap silently punishes the languages you claimed to include. A question cap plus a spend cap is the pair.

If Redis or the limiter is unhappy, fail closed to the certified static page. A blinking inauguration is cheaper than an unbounded meter or an unbounded personal retrieval. Write fail closed so nobody is brave for a ribbon.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Rate Limiting Citizen-Facing AI Services” is a path problem. A P4 Security/CISO should be able to name the tool, the identity, the secret and the egress that would make “rate limiting AI service” real. If the only control is a network diagram from last year, you have a story, not a threat model.

Rate limits are not a WAF decoration. They are how a public agent survives a flood, a loop and a councillor's share-link. Cap identity, IP, verbs and rupees. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Rate Limiting Citizen-Facing AI Services” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Security/CISO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “rate limiting AI service” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next file must contain

“Rate Limiting Citizen-Facing AI Services” earns a line in the noting only if a P4 Security/CISO can attach proof of “rate limiting AI service.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “rate limiting AI service.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.