A managed node executes one or more applications. The applications utilize the resources of the node. A quality-of-service (QoS) agent on the managed node enforces a QoS policy for the node. The QoS agent characterizes an application's usage of the node's resources and predicts its future usage. The QoS agent analyzes the predicted resource usage in view of the QoS policy and generates a QoS envelope for the application. The QoS envelope specifies a ceiling on the level of resources that can be used by the application. The QoS agent queues and meters usage above the ceiling specified by the QoS envelope. A security module determines variations between predicted and actual resource usage and generates security events if warranted.