IAM-based enforcement

Jamf enforces per-engineer Bedrock budgets by rewriting an IAM policy every 15 minutes

The loop reads Bedrock invocation logs through Athena, prices them at published rates, and denies Claude Opus at 80 percent of an engineer's daily budget. It transfers only if every model call carries a federated user identity.