Tokenomics at scale: How Jamf built real-time spend enforcement for Amazon Bedrock

As organizations increasingly adopt generative AI, managing associated costs becomes a critical challenge. Unlike traditional compute costs, AI spend scales with usage behavior, making it difficult to predict and control until the bill arrives. Jamf, a provider managing Apple devices for over 76,000 organizations, faced this issue when expanding AI access via Amazon Bedrock. To ensure cost governance, they built a system that tracks individual user spending and enforces tiered model restrictions dynamically.

The solution involves logging each Amazon Bedrock invocation, calculating daily spend per user using Amazon Athena, and applying restrictions through AWS IAM Customer Managed Policies. An AWS Lambda function runs every 15 minutes, assessing current spend against thresholds, updating policies, and notifying users via Slack. When a user exceeds a threshold, their access to certain models is temporarily denied, with restrictions automatically lifting at the next daily reset.

This architecture addresses three core concerns: measuring spend, deciding restrictions, and enforcing them. It leverages serverless components for scalability and automation, ensuring minimal latency and disruption. The system also includes an exception workflow, allowing administrators to grant temporary higher limits through Slack commands, which are automatically revoked after a set period.

Implementing this system in production revealed insights into cost management, such as optimizing Athena queries to reduce expenses and maintaining a flexible, scalable policy management process. The approach demonstrates that effective cost governance can accelerate AI adoption by providing transparency and control, enabling organizations to confidently expand their AI initiatives without fear of runaway costs.