Rate limits for AI-built apps

Why This Matters

Protect auth, uploads, APIs and model spend from abuse. This is one of the most commonly missed steps when moving AI-built apps to production.

Step-by-Step Implementation

1. Assign ownership: One person must be responsible for this area
2. Audit current state: Document what exists today and what's missing
3. Define the target: What does "done" look like for your app?
4. Implement incrementally: Start with the smallest safe baseline
5. Test both paths: Verify expected behavior AND failure behavior
6. Document evidence: Screenshot configs, save test results
7. Set up alerts: You should know when this breaks, not your users
8. Review quarterly: Re-check after every major stack change

Common Mistakes

• Assuming the builder handles this automatically
• Copying configuration from preview to production
• Not testing failure scenarios
• Forgetting to document the setup
• Skipping monitoring and alerts

Verification Checklist

• Can you demonstrate this works with a non-admin user?
• Do you have alerts configured for failures?
• Is this documented somewhere other than someone's head?
• Has this been tested in the actual production environment?