Tokenomics at scale: How Jamf built real-time spend enforcement for Amazon Bedrock
Jamf built a production-grade AI FinOps system that enforces tiered spend limits on Amazon Bedrock usage in near-real-time at the individual engineer level The architecture uses Amazon Athena for cost measurement, AWS Lambda for enforcement decisions, and IAM Customer Managed Policies for live policy enforcement without re-authentication The system denies premium models (Claude Opus at 80% budget, Sonnet at 100%) while preserving access to low-cost models (Haiku), with automatic daily resets and
Analysis
TL;DR
- Jamf built a production-grade AI FinOps system that enforces tiered spend limits on Amazon Bedrock usage in near-real-time at the individual engineer level
- The architecture uses Amazon Athena for cost measurement, AWS Lambda for enforcement decisions, and IAM Customer Managed Policies for live policy enforcement without re-authentication
- The system denies premium models (Claude Opus at 80% budget, Sonnet at 100%) while preserving access to low-cost models (Haiku), with automatic daily resets and a documented exception process
- Slack notifications alert engineers when they cross spending thresholds, ensuring restrictions are never a surprise
- The solution demonstrates that AI token spend behaves fundamentally differently from traditional compute, scaling with user behavior rather than provisioned capacity
Why It Matters
This case study addresses a critical gap in enterprise AI adoption: the "tokenomics problem" where AI spend is invisible until billing cycles arrive, making cost control and ROI measurement nearly impossible. As organizations like Jamf expand AI access to engineering teams, this architecture provides a production-tested blueprint for balancing productivity gains with financial accountability. The approach is directly applicable to any organization using AWS Bedrock or similar generative AI services who need per-user visibility and real-time enforcement without disrupting active workflows.
Technical Details
- Cost Measurement: Amazon Bedrock invocation logs (model ID, token counts, user identity) are delivered to Amazon S3. An Amazon Athena view (
bedrock_cost_today) computes per-user daily spend by multiplying input/output tokens against published model rates, querying raw logs in place without a separate data pipeline - Enforcement Architecture: A serverless AWS Lambda function runs every 15 minutes via Amazon EventBridge schedule, reading current spend from Athena and cross-referencing an Amazon DynamoDB exceptions table for time-boxed custom limits
- IAM-Based Policy Enforcement: The Lambda uses
iam:CreatePolicyVersionto publish updated Customer Managed Policies targeting specific users viasaml:subcondition keys. These policies are attached to IAM permission sets and evaluated live on each Bedrock call without requiring re-authentication - Notification System: DynamoDB state tables track each user's previous restriction state; when spend crosses a new threshold, the handler sends a one-time Slack direct message to prevent surprise restrictions
- Fail-Safe Design: Unmapped models default to the highest pricing tier rather than $0, preventing cost bypass through unrecognized model usage
Industry Insight
- AI FinOps is becoming a prerequisite for enterprise AI adoption: Organizations must establish per-user spend visibility and real-time enforcement before expanding AI access, as traditional compute cost models do not apply to behavior-driven token consumption
- Serverless architectures enable practical AI governance: The Lambda-Athena-IAM pattern demonstrates that real-time enforcement is achievable without maintaining dedicated infrastructure, making it accessible to organizations of varying sizes
- Tiered model access with fallback options preserves productivity: By denying premium models while maintaining access to cheaper alternatives, organizations can control costs without completely blocking engineering workflows—a pattern that should be replicated across AI adoption initiatives
Disclaimer: The above content is generated by AI and is for reference only.