The load-bearing detail is that IAM evaluates the policy on every call, so the engineer's SSO session credentials stay valid and the next `bedrock:InvokeModel` simply returns a deny [10]. Nothing has to be restarted and no token has to be refreshed [13]. A spend control that required re-authentication would be a spend control engineers route around, and the whole design rests on that property.
Then the arithmetic on the loop. The handler is on a 15-minute EventBridge schedule [7], which is 96 evaluations a day [16]. Between two evaluations, nothing in this architecture limits spend. The tier band is 20 percentage points of the daily budget wide, because Opus is denied at 80 percent and Sonnet at 100 [11][17]. So the smallest unit of overshoot is one interval at an engineer's peak burn rate, and if 15 minutes of Sonnet clears a fifth of the daily budget, the Opus denial never functions as an early brake. The AWS post says restrictions take effect within minutes [13], which is true of the enforcement action. The decision behind it can be a quarter of an hour behind the spend, plus whatever latency Bedrock adds delivering invocation logs to S3 [5].
Two things have to be true for the dollar figure to mean what you want it to mean. First, the Athena view computes per-user daily spend by multiplying logged token counts against published model rates [6]. That is a list-price reconstruction from logs, and it will diverge for anyone whose Bedrock pricing is not the published rate. Second, the customer managed policies target specific users through a `saml:sub` condition key [9]. Bedrock traffic arriving under anything that is not a federated user identity has no `saml:sub` for the condition to match, so a shared application role or a CI role sits outside the budget while still landing on the bill. Given the premise in the post, that one engineer in an agentic loop can burn more tokens in a few hours than a team burns in a week [15], the unattributed lane is where I would look first.
The Haiku carve-out is the good engineering here. Opus and Sonnet get denied at their thresholds, Haiku never does, and the engineer keeps a low-cost model to work with [11][12]. The model degrades, but the capability stays available. The one-time Slack DM per tier [8] means the engineer finds out why their agent got worse from a message rather than from a stack trace.
The object to watch in operations is the CMP itself. It hangs off the IAM permission set [10], and the Lambda holds `iam:CreatePolicyVersion` against it [9]. That makes a malformed policy version an organisation-wide deny, propagating with the same speed and the same absence of re-authentication that makes the intended case work. If you build this, the exceptions table in DynamoDB [7] and the documented time-boxed exception process [14] serve as the release valve you will need the first time the measurement is wrong, not as paperwork.
