We are testing the new AI-assisted form fill feature (Extract and fill fields with AI on a file upload field, September 2026 release). It works well on authenticated forms. Before we put it on a public form we have two concerns and want to know the intended guidance.

1. Extraction runs on upload, not on submit. In our testing the file card shows Extraction complete as soon as the file lands, before the submitter clicks Submit. On a public form an anonymous visitor can upload a file, refresh the page, and upload again, consuming an AI unit each time without ever submitting. Is there any throttling or rate limiting on extraction for unauthenticated sessions, per IP, per session, or per form? If so, what are the thresholds?

2. There is no attribution for the spend. The Plan page shows the yearly total and the Usage by service breakdown, which tells us form fills as a category. It does not show which process, which form, which user, or when. We do not see an audit event for AI extraction in the Cloud audit event list, and an abandoned public upload creates no instance in Forms reports. If the form fills count climbs unexpectedly, we have no way to identify the source or prove it was abuse rather than legitimate use. Is there an audit event, report, or log that records each extraction with the process, form, user or anonymous flag, IP, timestamp, and units consumed? If not, is one planned?

3. Is AI-assisted form fill intended to be supported on public forms at all, or is the guidance to restrict it to authenticated forms? Is there or will there be a setting to allow AI fill only for logged-in submitters, or to skip extraction when the initiator is Anonymous?

Thank you!