Limit size and/or frequency of user queries in SQL Server - sql-server

Question

Is it possible to put a cap on the "size" and frequency of user queries in SQL Server (or perhaps another engine)? For example:
Let's say there are a few tables with millions of rows. Maybe there's a handful of admins and analysts working on the tables, and they'd know their way around enough to not run any unnecessary heavy queries that may run for several minutes/hours.
However, a sales/marketers/admin staff less familiar with SQL is more likely to run a heavy query e.g. with loads of joins, whether accidently or just for the fun of it. Multiply this by dozens of them, and the server can be severely hammered at.
Ideally, I'd want restrictions like the following:
If the engine anticipates there'll be above a million row scans, cancel the query (and tell the user why it was cancelled).
Limit queries being run by a single user to 20 queries within a 10-minute window.
User/role-level "caps"

Answer 1

You have pretty radical requirements for code execution. There is nothing out of the box that will work for you. However, you can implement certain things to achieve what you are trying to achieve here:
Do not give users access to tables directly, create procs and only give access to procs.
Inside the procs you can get all fancy with limiting the maximum number of rows a user i can return by adding top clause.
Create an Audit table and inside the proc every time a user makes a call to a proc add a row to that audit table, also the very first step could be to check how many rows are already in the audit table for that proc for the caller (how many times user has already executed the proc) and raise an error if the user has already exceeded the limit etc. you get the idea.
I would suggest not to limit the cost of query, this would come back to haunt you, for many reasons, write the queries/Procs yourself or someone you trust to write efficient code.
Something like this....
CREATE PROC dbo.usp_Test
AS
BEGIN
SET NOCOUNT ON;
Declare #UserCalls INT;
SELECT #UserCalls = Count(*)
FROM dbo.AuditTable
WHERE UserName = SUSER_SNAME()
AND ProcName = 'usp_Test'
AND Logged >= DATEADD(MINUTE , -1 , GETDATE());
IF (#UserCalls >= 10)
BEGIN
RAISERROR ('Come back in 1 minute, you have exceeded 10 execution/min limit' , 16 , 1);
RETURN;
END
ELSE
BEGIN
INSERT INTO dbo.Audit (ProcName , UserName , Logged)
VALUES ('usp_Test' , SUSER_SNAME() , GETDATE());
END
/* Rest of the code */
SELECT TOP (1000) *
FROM ...........;
END

Answer 2

The feature you're looking for is called Resource Governor.
You can classify incoming connections and assign them to a Workload Group, which specifies
CREATE WORKLOAD GROUP group_name
[ WITH
( [ IMPORTANCE = { LOW | MEDIUM | HIGH } ]
[ [ , ] REQUEST_MAX_MEMORY_GRANT_PERCENT = value ]
[ [ , ] REQUEST_MAX_CPU_TIME_SEC = value ]
[ [ , ] REQUEST_MEMORY_GRANT_TIMEOUT_SEC = value ]
[ [ , ] MAX_DOP = value ]
[ [ , ] GROUP_MAX_REQUESTS = value ] )
]
[ USING {
[ pool_name | "default" ]
[ [ , ] EXTERNAL external_pool_name | "default" ] ]
} ]
[ ; ]
And maps to a Resource Pool which has limited access to server resources.
In the SQL Server Resource Governor, a resource pool represents a
subset of the physical resources of an instance of the Database
Engine. Resource Governor enables you to specify limits on the amount
of CPU, physical IO, and memory that incoming application requests can
use within the resource pool. Each resource pool can contain one or
more workload groups.
It's important to combine Resource Governor with snapshot-based reads for the reporting users, either using SNAPSHOT isolation, or by setting the database to READ_COMMITTED_SNAPSHOT. Otherwise a reporting user with limited access to resources can acquire locks that interfere with other workloads.