Start from your cost
Decide what one new person should be able to use for free, and what that costs you. Everything else is a rule built on that number.
Choose a unit
Use a credit that fits your product: requests, tokens, minutes or images. The unit only needs to be consistent between what you hand out and what you measure.
Pick a window and a pause
A common shape is a cap within a window, then a pause. For example: 500 credits in 4 hours, then a 4-hour pause. A longer pause protects your budget; a shorter one feels kinder. These are starting points, not benchmarks.
Try a rule
Pause a device for 4 hours after it uses 500 credits within 4 hours.
At most 1500 credits in a day, if a device uses its whole cap at the start of every window. Orange is a window, grey is a pause.
A starting point to think with, not a benchmark.
Meter the person, not the account
If every new email gets a fresh allowance, the cap does little. Tie the meter to the device and the person behind it.
Use soft steps first
Move from allow to limit, then verify, then pause, and keep blocks for clear cases. Tell the user plainly what happened and when they can come back.
Review with evidence
Look at who is hitting the cap. If likely true users hit it often, the cap is too tight. If abusers rarely do, it may be too loose.
