The bill records the account and not the team
A cost vendor, a platform and a regulator all landed on the same thing this week: a control is only as fine as the unit it is drawn at.
How we Organise
Token spend had to be labelled at the call, or it could not be found afterwards
Vantage has shipped per-team attribution of AWS Bedrock spend. It reads the invocation logs out of the customer’s own bucket, groups token usage by the metadata the application attached to each request, and splits each cost row in proportion to token share. Neither billing export carries a Bedrock request ID, so the match is a reconciliation rather than a join. Bedrock takes up to sixteen labels on a request, and invocation logging is off by default in every account and region. The application has to label the call while it is making it.
We tell a client that a team which cannot say what it spent on models is not a team anybody can hold to a number. The practice says it plainly:
The team has a cost line of its own, and it includes tokens.
What is newly evidenced is the price. The account and the calling identity are all the invoice records, so the team boundary has to be emitted at the moment of the call or it is not there to recover. A firm whose identities already map to its teams probably needs none of this. Everybody else is looking at a bill that stops one level above the thing they wanted to know.
How we Build
Cloudflare now lets you scope a teammate or an agent to a single Worker, under four roles. One exposes settings and traces but not code. One exposes the code without deploying it. One deploys but cannot delete. One can delete. A CI job or an agent can hold the third on one application and nothing else in the account. Changing the route that carries production traffic needs a second permission on the zone. Cloudflare says the same four will reach D1, R2 and KV next.
Our position is that an agent should hold a credential of its own, and that somebody should have worked out what it could wreck before it runs:
Each agent acts as a named identity in the architecture register, and its blast radius is computed on the assumption that everything it reads is hostile.
Cloudflare’s own first sentence is the failure that makes the case. What you are guarding against is an agent changing production because it was handed more than it needed. The second half of ours is untouched here, since nothing in the release concerns what the agent reads, and the grant is still issued by a person rather than inherited from whoever asked.
How we Assure
One account reached 524,867 patient records and nobody noticed for days
The French regulator has fined a private hospital 500,000 euros. An attacker signed in during summer 2025 through a route with no VPN and no second factor. The access policy did not model the care team. One stolen account therefore reached all 524,867 patients the hospital held, rather than the patients that user was treating. It reached 202,246 named trusted third parties as well. Nothing watched for unusual activity. The attacker moved through the system for several days and took a very large volume of data before anybody saw it.
We judge a control by whether somebody would notice it failing, not by whether it is written down:
You cannot govern what you cannot see.
The regulator reasoned the same way when it fixed the number. What set the scale was not the weak sign-in but the days that passed with nobody looking. The decision reports the failures rather than the design, so it cannot tell us whether detection was absent or merely ignored. A reader could fairly say the entitlement fault did the real damage and the blindness only extended it.