Detects deletion of an extra_usage_spend_limit in Anthropic audit logs (event.action == extra_usage_spend_limit_deleted). The rule flags potential abuse by an actor with administrative or API access who removes a spending guardrail, possibly enabling unrestricted Claude/API usage, large automated workloads, or budget burn. The deletion itself does not generate spend but serves as an early signal for follow-on quota abuse. Triage guidance: correlate with nearby create/update events for a replacement limit, verify actor identity (user_actor → user.email/source.ip/UA; api_actor → anthropic.audit.actor.api_key_id) and inventory, and inspect for subsequent high-volume activity (claude_chat_created, file uploads) within the same organization. False positives often occur during billing policy consolidations when an old limit is deleted before a new one is created. Remediation: restore an appropriate spend limit, review active API keys and admin sessions, and quantify spend after the change. Investigation guidance also includes conditioning on the presence of a replacement limit and escalation if deletion is orphaned or followed by anomal usage spikes. The rule aligns with MITRE ATT&CK under Resource Hijacking (T1496) in the Impact tactic (TA0040).