A consumption baseline is the normal pattern of AI usage for a specific application or agent. It includes which models are called, how many tokens are used, when requests occur, and from where. Baselines help teams distinguish legitimate workload variation from credential abuse or agent compromise.
What a consumption baseline measures
A consumption baseline is the normal usage profile of an AI application or agent. It captures expected model calls, token volume, timing, and request sources so teams can spot abnormal shifts without treating every spike as malicious.
The idea matters because AI workloads are dynamic. Legitimate changes can come from seasonality, a new workflow, prompt changes, or a larger user population. A baseline gives operators a reference point for deciding when variation is ordinary and when it deserves investigation.
Why it is useful for detection
Consumption baselines are a practical detector for misuse because many abuse patterns first appear as changes in volume, cadence, source location, or model selection. A stolen credential, compromised agent, or runaway automation often leaves a footprint in how the system consumes tokens and services.
That makes the baseline a behavior reference, not just a cost-management metric. It helps separate normal workload growth from unusual activity, especially when the change is subtle enough that no single request looks suspicious on its own.
What should be included in the baseline
A useful baseline usually includes the models being called, typical request rates, average and peak token use, common source locations, and the time windows in which activity normally occurs. For agentic systems, it may also need to reflect tool-call patterns and the expected sequence of requests.
The baseline should be specific to the application or agent rather than generalized across the environment. A shared service, a batch job, and an interactive assistant can all be valid AI workloads, but they will produce very different consumption patterns and should not be measured against the same normal.
How to interpret deviations
Not every deviation is an incident. New releases, a changed prompt, a workflow expansion, or a sudden business event can all alter usage. The key question is whether the new pattern is explainable, repeatable, and consistent with approved change.
Unexplained shifts matter most when they combine multiple signals, such as a different source region, a spike in token usage, and an unfamiliar model or tool invocation pattern. In that case, the baseline is acting as an early-warning mechanism for either abuse or compromised automation.
Risk and Threat Considerations
Consumption baselines help expose credential abuse, agent compromise, and runaway automation because these conditions often change usage patterns before they trigger an obvious functional failure. The main risk is false confidence if the baseline is too broad, too static, or shared across workloads with different operating profiles.
Failure mechanism: An attacker or compromised agent can reuse valid access to make requests that look syntactically normal while still producing abnormal volume, cadence, source distribution, or model selection. A poorly tuned baseline may miss the drift or flag routine growth as suspicious.
Impact: Teams may overlook account abuse, uncontrolled token consumption, data exfiltration through repeated prompts, or a compromised agent that silently changes behavior over time. Detection quality and cost control both degrade when the baseline no longer reflects real workload shape.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Consumption baselines support anomaly monitoring for unusual AI usage patterns. |
| ID.RA-03 — Threats, Vulnerabilities, and Likelihoods Are Used to Inform Risk Assessments | The baseline helps distinguish normal variation from abuse or compromise risk. | |
| Recommendation — Compare AI consumption patterns to expected baselines and investigate meaningful deviations. Use consumption deviations as risk signals when assessing likely abuse or compromise. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Usage baselines create audit signals for abnormal activity review and correlation. |
| SI-4 — System Monitoring | Normal consumption profiles support monitoring for suspicious model-call behavior. | |
| Recommendation — Correlate AI usage telemetry and review baseline breaks as audit anomalies. Monitor AI request behavior against established consumption baselines. | ||
| CIS Controls v8 | 8 — Audit Log Management | Baseline-driven detection depends on consistent telemetry for AI activity analysis. |
| Recommendation — Collect and analyze AI usage logs so baseline deviations are visible. | ||
Practitioner Guidance
Why practitioners should care: Consumption baselines are most valuable when they are tied to a specific application, agent, and operating context, not to an average across all AI activity. That keeps the signal useful when investigating whether a request pattern reflects expected workload change or something that deserves escalation.
What to watch for: Treat changes in token growth, source geography, model mix, and request timing as a combined pattern rather than a single metric. A baseline is strongest when it supports operational judgment, not when it is used as a blunt threshold.
