Explain how valid reservations can consume availability
Consider a booking service that lets signed-in users hold appointments before confirming them. One person repeatedly creates accounts and holds scarce slots without completing a booking. Each request may be well formed and authorized. Together, the holds consume the inventory and prevent other customers from finding appointments. The problem becomes visible when the requests are examined as a sequence.
A per-IP limit can also affect legitimate people sharing a school or office connection. Before choosing it, define the intended reservation behavior: how long a hold lasts, how many may coexist, when they are released and when additional verification is needed. Test those choices against the harmful sequence and against customers who need to book normally.
Connect the observed behavior to an intervention
Keep a decision record for each harmful outcome. Separate observed behavior from suspicion, and identify the least disruptive intervention that addresses what was demonstrated. Include legitimate exceptions and a route back into the service when a restriction is wrong. Otherwise, the control can leave ordinary users with no practical way to recover.
| Field | Reservation example |
|---|---|
| Protected outcome | Customers need to be able to book appointments that are genuinely available. |
| Abuse sequence | Repeated holds consume the inventory without progressing to confirmation. |
| Observable evidence | Relate hold creation, expiration and confirmation to the availability customers encounter. |
| Control hypothesis | Test whether a bound on active holds and reliable expiration reduce the observed harm. |
| Legitimate exception | Account for authorized coordinators who book on behalf of a group. |
| User recovery | Provide an explanation, a usable retry path and a way to escalate to support. |
| Privacy constraint | Justify the signals collected and define who may access them and how long they are retained. |
Measure the outcome for affected and legitimate users
Use a limited inventory in a test environment to replay controlled scenarios. Check that a hold expires after the client disconnects, concurrent requests stay within the intended allocation and a retry does not create another reservation. Test ordinary bookings and the documented coordinator exception as well. Those are behaviors the control needs to preserve.
Measure legitimate completions, wrongly restricted users, available inventory and support workload. Lower request volume alone does not demonstrate improvement; a control that blocks ordinary bookings can produce that result too. Compare outcomes over a defined period, account for demand changes and retain the configuration used. Then decide whether the intervention helped.
Review account recovery and sensitive changes separately. A convincing voice or video does not authorize bypassing the established process. Provide an accessible alternative for users who cannot complete one verification method. Investigators also need enough context to evaluate the case without treating a single behavioral signal as proof of guilt.
Keep the decision open to review
OWASP API guidance addresses unrestricted access to sensitive business flows. NIST digital identity guidance can inform authentication and recovery. Successful identity verification, however, does not establish that every subsequent permitted action is legitimate. The product still needs to evaluate how its features are being used.
Thresholds depend on the product's economics, the harm and the needs of its users. Record who can change them and who reviews appeals. Explain why the available evidence supports this intervention. The result is a decision about this product, not a universal fraud score or a reason to collect every personal signal available.
Sources and reference editions
- OWASP API Security Project2023
- NIST Digital Identity GuidelinesSP 800-63-4, July 2025
- OWASP GenAI Security ProjectCurrent 2026 LLM and Agentic Applications resources