A hard token cap is a fixed runtime limit on the number of tokens an AI system can process or generate during a request, session, or time window. Unlike a soft budget that warns or degrades gracefully, a hard cap stops the request when the limit is reached. It is used to control spend, prevent runaway prompts, and keep large workloads from consuming shared capacity.
In cyber security, hard token caps are a practical control against abuse. An attacker can try prompt stuffing, recursive tool calls, or oversized context windows to raise cost, delay service, or force model errors. A cap helps contain that behavior and protect availability, but it can also cut off useful context, reduce answer quality, and trigger retries if set too low. Good defenses pair caps with logging, per-user quotas, and workload-specific limits so security and reliability stay balanced.