Usage Limits
Add rate limits that cap how many tool calls a user, agent, or MCP server makes in a time window.
In the console: Controls › Usage Limits
Usage Limits lists your rate limits: rules that cap how fast agents call tools. Every matching rule must have budget left for a call to go through, so an organization-wide limit and a tighter per-user limit both apply. Use this screen when you add or change a limit, or check which limit refused a call.
Rate limits
| Column | Shows |
|---|---|
| Name | The rule name and its condition, when it has one |
| Scope | Which agents, users, MCPs, and tools the rule applies to |
| Budget | How many calls the rule allows per window, and the burst size when it is above 0 |
| Key | What the budget is counted per: user, agent instance, MCP server, tool, or org-wide for one shared budget |
| Action | deny (refuse calls over budget) or log only (record them and let them through) |
| Status | Draft (saved, not enforced), Active (enforced), or Disabled (paused) |
With no limits, the screen shows No rate limits yet and an Add your first rate limit button.
Actions
- Add rate limit – opens the rate limit editor.
- Edit (row menu, or click the row) – opens the rule in the same editor.
- Delete (row menu) – asks you to confirm in a Delete rate limit dialog. You can't undo it.
The rate limit editor has a name field, a status picker, and a sentence that starts with Throttle tool calls by, followed by the agents, users, MCPs, and tools it applies to. You can add a condition, written in CEL. Under Budget, set:
- Calls – how many calls the budget allows.
- Window – a number and a unit (second, minute, or hour). A window can't be longer than one hour.
- Counted per – the dimensions that each get their own budget. Leave it empty for one budget across the organization.
- Burst – how many calls may go through together. 0 releases one at a time. It can't be more than Calls.
Under When the budget runs out, a switch chooses between Refuse the call and Log only: let the call through. Log only records what the rule would catch without changing traffic, so you can check a rule before you enforce it.
Permissions
- To see the screen, you need
view_rate_limits. - To add, edit, or delete a rate limit, you need
manage_rate_limits. Without it, rows are read-only and the add button and row menu are hidden.
Related
- Rate limits concepts – how budgets, keys, and bursts are counted