If you're building an app on top of OpenAI or Anthropic, you've probably noticed something uncomfortable: there's no native way to limit how much any individual user can cost you.
OpenAI gives you org-level spend caps and project budgets. These protect OpenAI's billing relationship with you. They don't protect you from the one user who discovers they can run your AI feature in a loop at 3am and generate $400 in API costs before you wake up.
I learned this the hard way. Twice.
Why the obvious solutions don't work
The first thing most developers try is an org-level spend cap. Set it to $100/month and call it done. The problem is that cap applies to your entire organisation. One heavy user can consume it entirely, leaving everyone else with nothing. You also have no visibility into who did it.
