A denial of service caused by one model could bring down the entire server, but
we don't consider this as a vulnerability, given that models can exhaust
resources in many different ways and solutions exist to prevent this from
happening (e.g., rate limits, ACLs, monitors to restart broken servers).

### Model sharing

If the multitenant design allows sharing models, make sure that tenants and

                                       TF_FileStatistics* stats,
                                       TF_Status* status);

// Creates or truncates the given filename and returns a handle to be used for
// appending data to the file. If status is TF_OK, *handle is updated and the
// caller is responsible for freeing it (see TF_CloseWritableFile).
TF_CAPI_EXPORT extern void TF_NewWritableFile(const char* filename,