Nano Solutions
(08) 6365 5360 Book a Free Discovery Call

ASD Says Treat AI Tokens Like a Budget. Here's How

9 min read Petr Červenka Petr Červenka
ai cybersecurity
ASD Says Treat AI Tokens Like a Budget. Here's How
Photo by Mohammed Kateregga on WordPress Photo Directory
On this page 8 sections
  1. What ASD says
  2. Two ways the bill hurts you
  3. Decide now what gets throttled first
  4. What would a bad week cost you?
  5. What to do this week
  6. For the technical team
  7. Frequently asked questions
  8. Sources

The short version

  • On ASD published guidance on managing AI token consumption, written with its Canadian, US, UK and New Zealand counterparts. It treats tokens as a cost, a capacity limit and a security risk.
  • Two failure modes it names: token exhaustion, where you hit your own quota and lose the service, and denial-of-wallet, where someone else spends your money on purpose.
  • Its concrete asks are small: set alerts as you approach your limit (its example is 70%, 80% and 90%), split usage into three priority tiers, cap outputs, bound agent loops, and put a proxy or gateway in front so you can see usage per team.
  • If you run a customer-facing chatbot or an agent with a public endpoint, this is a this-week job. If AI is internal-only, it is a this-month job.

If your business pays for AI by the token, the bill moves around. Most businesses lack a number they can defend to finance, and a stop button for the day someone points a script at their chatbot.

On 23 October 2026 the Australian Signals Directorate published Managing AI token consumption for operational resilience. The Canadian Centre for Cyber Security led it, with ASD's ACSC, the US CISA and the UK and New Zealand cyber centres as co-authors. There is no vulnerability here, just an ordinary problem: organisations depend on AI they pay for by use, and most cannot say what a bad month looks like until it arrives.

What ASD says

Tokens are the units a model reads and writes. You pay for input (what you send) and output (what comes back). The guidance asks you to understand the pricing "prior to engaging with vendors and signing service level agreements or contracts." Ask about quota limits and overage pricing before you sign.

Usage grows quietly: chat history resent with every request, connectors to other platforms, and agents where "each step reprocess[es] prior content and tool outputs." One chat message is cheap. A five-step agent that re-reads a 40-page document at every step is not.

Two ways the bill hurts you

Token exhaustion. You hit a quota, rate limit or budget threshold, and the service slows or stops. "Users and systems may experience delays, degraded performance, failed requests, or loss of access to AI capabilities." ASD's fix is alerts that escalate as you approach the limit. Its example is 70% (information), 80% (warning) and 90% (critical).

Denial-of-wallet. Someone uses your endpoint so that you pay. ASD describes attackers exploiting "consumption-based, usage-based, and pay-per-use pricing models to increase costs," with prompts that force long answers or loops that feed output back in. Its cousin, denial-of-tokens, burns your quota so your own users lose access.

Neither needs a bug in your code. Your endpoint only has to accept work from people you did not mean to serve.

A row of electronic electricity meters with digital displays
Metered services are easy to budget for until the meter is on someone else's wall. Photo by Mamlik on Wikimedia Commons.

Decide now what gets throttled first

ASD recommends three priority tiers, so routine work cannot eat the capacity that critical work needs:

  • Tier 1, mission critical: cyber defence and incident response. Protected capacity.
  • Tier 2, operational: essential processes such as compliance work. Monitored and managed.
  • Tier 3, productivity: emails, meeting summaries, research. Limited first when demand is high.

In a 30-person business, Tier 1 might be the after-hours support bot and Tier 3 the staff ChatGPT seats. Decide the order now, not at 4:55 pm on a Friday. ASD also asks for a governance group and fallback plans with "human oversight at key decision points." For a small business that is one page: four names, a priority order and a fallback.

What would a bad week cost you?

Pick what you run, adjust the sliders, then simulate a bad week. Check the result against your own invoice.

Try it

AI token cost and bad-week estimator

What are you running?

a request · a year

a normal month. The bad week alone: .

Model

1 for a simple chatbot. Agents often make 5 to 10.

Instructions, documents and chat history. 1,000 tokens is about 750 words.

The answer. Output costs about five times as much as input.

Assumptions behind the numbers

All figures in US dollars, because that is how the providers bill. Rates are examples for planning, not quotes, based on October 2026 list prices from Anthropic, OpenAI and Google: frontier US$10 per million input tokens and US$50 per million output, mid-tier US$2 and US$10, small US$0.10 and US$0.50, local US$0. Prompt caching assumes about half the input is cached (most of it for the agent preset), costed at 10% of the input rate; cache-write charges are ignored. A month is 30 days. A bad week is three days at a traffic multiplier plus four normal days. The multipliers are our assumptions, not ASD figures: 3x for staff-only use, 20x for a public endpoint with a hard cap, 100x for a public endpoint without one. Nothing you enter leaves this page.

A person typing on a laptop that shows analytics charts, with a cup of coffee beside it
A token baseline turns an unpredictable bill into a line item you can forecast. Photo by Negative Space on StockSnap.

What to do this week

  1. Work out your cost per request. Divide the last three invoices by request volume.
  2. Set the three alerts. 70%, 80% and 90%, on both quota and budget. If your provider cannot do this, raise it at renewal.
  3. Sort every AI use into the three tiers. Write down what gets throttled first.
  4. Lock down what the public can reach. Sign-in, per-user rate limits, a maximum output length and a cap on agent loops. Do this first if you run a customer-facing chatbot.
  5. Write the fallback. If the model is down, what does the team do instead? If the answer is "nothing", that is the finding.
  6. Plan a proxy or gateway for next quarter. ASD calls AI proxies "an increasingly practical way for organizations to monitor and measure consumption and use, enforce quotas, apply guardrails and support chargeback."

For the technical team

  • Right-size the model. ASD: "Using the same high-cost model across all workflows is not necessary." A local model swaps token bills for hardware and staff time, as our 2015 GPU test showed.
  • Cap output and effort. Reasoning tokens are billed as output, the expensive half.
  • Cache deliberately. Put static instructions and documents at the start of the prompt so the cache can hit.
  • Bound the loops. Maximum iterations, tool calls and a timeout. An unbounded agent loop is a denial-of-wallet attack you wrote yourself.
  • Treat spikes as a security signal. ASD suggests watching unusual consumption "as a potential indicator of data exfiltration," and sending token telemetry to your SIEM. Use one API key per application so an abused integration cannot hide in the total.
  • Keep a second provider for outages and quota exhaustion.

Frequently asked questions

Is this guidance binding on Australian businesses?

No. It is guidance, not regulation, but it is what a government client, auditor or insurer will point at when they ask how you manage AI use.

We only use AI through staff subscriptions. Does this apply?

Partly. The seat price caps your spend, but shared seats still hit usage limits. The tiers decide who keeps access when they do.

What is the single cheapest control?

A maximum output length per call. It is one setting, and it limits what each abusive request can cost you.

Our cyber security team can review where your AI usage goes, and our software development team can add quotas, logging and fallbacks to an existing integration. Get in touch and we will start with your last three invoices.

Related reading: AI agents in business: what agentic AI actually means · AI agents built a message board and broke out · Fintech cloud costs: cutting the bill without breaking CPS 230

Photo credits. All images CC0 / public domain, free for commercial use:

Sources

Was this useful?

Share

Markdown
Petr Červenka

Petr Červenka

Petr is the founder and lead developer at Nano Solutions, a Perth-based custom software firm. With over a decade of experience building enterprise platforms for government and private sector clients, he leads delivery of complex projects across Australia.

Connect on LinkedIn