Tokenomics at scale: How Jamf built real-time spend enforcement for Amazon Bedrock

To address the issue of invisible and difficult-to-manage spending associated with generative AI, Jamf developed a real-time spending execution system based on AWS Lambda, Athena, and IAM customer management policies. This system tracks daily Amazon Bedrock consumption by engineers and automatically applies hierarchical model restrictions when budget thresholds are reached (e.g., blocking Claude Opus 80% of usage), while retaining access to low-cost models. Control measures take effect within 15 minutes without the need for reauthentication. The architecture uses EventBridge to trigger Lambda to read cost data calculated by Athena, combines it with DynamoDB exception table processing for special requirements, notifies users via Slack, and dynamically updates IAM policies to execute controls, aiming to achieve AI cost management without interrupting active sessions.